Archive

31 May 2014

Vulnerabilities first published on this day (UTC), newest first.

← April 2014 2014 / May /31 June 2014 →

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

Medium —

CVE-2014-0099

Improper Neutralization of CRLF Sequences in HTTP Headers in Apache Tomcat

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Conte…

org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-util Ubuntu Maven

May 31, 2014
Medium —

CVE-2014-0096

Improper Input Validation in Apache Tomcat

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrict…

org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven

May 31, 2014
Medium —

CVE-2014-0075 Public exploit EPSS 18%

Integer Overflow or Wraparound in Apache Tomcat

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumpti…

org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-coyote Ubuntu Maven

May 31, 2014
Medium —

CVE-2014-0095

Denial of service in Apache Tomcat

java/org/apache/coyote/ajp/AbstractAjpProcessor.java in Apache Tomcat 8.x before 8.0.4 allows remote attackers to cause a denial of service (thread consumption) by using a "Content-Length: 0" AJP request to trigger a hang in request processing.

org.apache.tomcat.embed:tomcat-embed-core org.apache.tomcat:tomcat-coyote Maven

May 31, 2014
Medium —

CVE-2014-0119

Missing XML Validation in Apache Tomcat

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web applicatio…

org.apache.tomcat:tomcat tomcat7 tomcat6 org.apache.tomcat:tomcat-catalina Ubuntu Maven

May 31, 2014
Unscored —

CVE-2014-3793

VMware Tools in VMware Workstation 10.x before 10.0.2, VMware Player 6.x before 6.0.2, VMware Fusion 6.x before 6.0.3, …

May 31, 2014