Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 213
Reset filtersApache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling
Apache Tomcat - AJP secret compared in non-constant time
Apache Tomcat - Digest authenticator will authenticate any unknown user
Apache Tomcat: LockOutRealm treats user names as case-sensitive
Apache Tomcat - Security constraints not correctly applied
Apache Tomcat - WebSocket authentication header exposure
Apache Tomcat - HTTP/2 request headers not validated
Apache Tomcat vulnerable to Insertion of Sensitive Information into Log File
Apache Tomcat has an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve
Apache Tomcat Missing Encryption of Sensitive Data vulnerability
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
Apache Tomcat has an HTTP Request/Response Smuggling vulnerability
Apache Tomcat has an Open Redirect vulnerability
Apache Tomcat: Padding Oracle vulnerability in EncryptInterceptor
Apache Tomcat has an Improper Input Validation vulnerability
Apache Tomcat: CLIENT_CERT authentication does not fail as expected
Apache Tomcat: Configured cipher preference order not preserved
Apache Tomcat - Security constraint bypass with HTTP/0.9
Apache Tomcat - Client certificate verification bypass
Apache Tomcat has an Improper Input Validation vulnerability
Apache Tomcat Vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.