CVE Intelligence

Vulnerabilidades de Maven

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Maven: 149 registro(s), com severidade, exploração e correções.

Org.apache.tomcat:tomcat 19Org.jenkins-ci.main:jenkins-core 9Com.fasterxml.jackson.core:jackson-databind 9Org.apache.tomcat.embed:tomcat-embed-core 9Org.apache.tomcat:tomcat-catalina 8Org.apache.struts:struts2-core 7Org.asynchttpclient:async-http-client 6Struts:struts 4Io.undertow:undertow-core 4Io.undertow:undertow-parent 3Org.apache.struts:struts-core 3Org.geoserver.web:gs-web-app 2Org.geoserver:gs-wms 2Org.apache.activemq:activemq-client 2Org.apache.solr:solr-core 2Org.apache.logging.log4j:log4j-core 2Org.ops4j.pax.logging:pax-logging-log4j2 2Org.springframework:spring-beans 2Org.apache.tomcat:tomcat-coyote 2Org.jenkins-ci.plugins:active-directory 2Org.connectbot.sshlib:sshlib 2Org.jenkins-ci.plugins.workflow:workflow-cps 1Org.springframework.data:spring-data-commons 1Org.primefaces:primefaces 1Org.geoserver:gs-wfs 1It.geosolutions.jaiext.jiffle:jt-jiffle 1It.geosolutions.jaiext.jiffle:jt-jiffle-language 1Org.apache.flink:flink-runtime 2.11 1Org.apache.flink:flink-runtime 2.12 1Org.springframework.cloud:spring-cloud-function-context 1Org.springframework.cloud:spring-cloud-gateway 1Org.apache.struts:struts2-struts1-plugin 1Org.apache.struts.xwork:xwork-core 1Com.guicedee.services:log4j-core 1Org.xbib.elasticsearch:log4j 1Uk.co.nichesolutions.logging.log4j:log4j-core 1Org.apache.struts:struts2-rest-plugin 1Org.apache.shiro:shiro-core 1Com.liferay.portal:com.liferay.portal.kernel 1Org.sonatype.nexus:nexus-extdirect 1

Somente exploradas (KEV) →

CVE-2016-1181 Alta · 8.1 04/07/2016
Improper Input Validation in Apache Struts
ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary code or cause a denial of service (unexpected memory access) via a multipart request, a related issue to CVE-2015-0899.
CVE-2015-0899 Alta · 7.5 CWE-20 04/07/2016
Improper Input Validation in Apache Struts
The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page parameter.
CVE-2016-4437 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-321 07/06/2016
Apache Shiro Code Execution Vulnerability
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
CVE-2016-3088 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-434 01/06/2016
Apache ActiveMQ Improper Input Validation Vulnerability
The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CVE-2016-3081 Alta · 8.1 KEV Urgente · 76 Exploit público CWE-77 26/04/2016
Apache Struts Command Injection Vulnerability
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2016-0763 Média · 6.3 CWE-264 24/02/2016
Improper Verification of Source of a Communication Channel in Apache Tomcat
The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
CVE-2016-0714 Alta · 8.8 CWE-264 24/02/2016
Improper Access Control in Apache Tomcat
The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 mishandles session attributes, which allows remote authenticated users to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that places a crafted object in a session.
CVE-2016-0706 Média · 4.3 CWE-200 24/02/2016
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat
Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
CVE-2015-5351 Alta · 8.8 CWE-352 24/02/2016
Apache Tomcat allows remote attackers to bypass a CSRF protection mechanism by using a token
The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
CVE-2015-5346 Alta · 8.1 24/02/2016
Improper Neutralization of Input During Web Page Generation in Apache Tomcat
Session fixation vulnerability in Apache Tomcat 7.x before 7.0.66, 8.x before 8.0.30, and 9.x before 9.0.0.M2, when different session settings are used for deployments of multiple versions of the same web application, might allow remote attackers to hijack web sessions by leveraging use of a requestedSessionSSL field for an unintended request, related to CoyoteAdapter.java and Request.java.
CVE-2015-5345 Média · 5.3 CWE-22 24/02/2016
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
CVE-2015-5174 Média · 4.3 CWE-22 24/02/2016
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat
Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
CVE-2015-5317 Alta · 7.5 KEV Alta · 59 CWE-200 25/11/2015
Jenkins User Interface (UI) Information Disclosure Vulnerability
The Fingerprints pages in Jenkins before 1.638 and LTS before 1.625.2 might allow remote attackers to obtain sensitive job and build name information via a direct request.
CVE-2014-7810 Média · 5.0 CWE-284 07/06/2015
Improper Access Control in Apache Tomcat
The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
CVE-2014-0230 Alta · 7.8 CWE-399 07/06/2015
Uncontrolled Resource Consumption in Apache Tomcat
Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.
CVE-2015-0254 Alta · 7.5 09/03/2015
XXE in Apache Standard Taglibs
Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.
CVE-2014-0227 Média · 6.4 CWE-19 15/02/2015
Improper Input Validation in Apache Tomcat
java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding.
CVE-2014-0119 Média · 4.3 CWE-264 31/05/2014
Missing XML Validation in Apache Tomcat
Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
CVE-2014-0099 Média · 4.3 CWE-189 31/05/2014
Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat
Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.
CVE-2014-0096 Média · 4.3 CWE-264 31/05/2014
Improper Input Validation in Apache Tomcat
java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2014-0075 Média · 5.0 CWE-189 31/05/2014
Integer Overflow or Wraparound in Apache Tomcat
Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.
CVE-2014-0114 Alta · 7.5 Exploit público CWE-20 30/04/2014
Arbitrary code execution in Apache Commons BeanUtils
Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.
CVE-2012-0391 Crítica · 9.8 KEV Urgente · 83 Exploit público CWE-94 08/01/2012
Apache Struts 2 Improper Input Validation Vulnerability
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
CVE-2006-1547 Alta · 7.5 KEV Alta · 59 CWE-749 30/03/2006
Apache Struts 1 ActionForm Denial-of-Service Vulnerability
ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.