Skip to content
OpenAdvisories

Archive

25 February 2016

Vulnerabilities first published on this day (UTC), newest first.

← January 2016 2016 / February /25 March 2016 →
  1. 121
  2. 2 
  3. 312
  4. 42
  5. 52
  6. 66
  7. 720
  8. 827
  9. 94
  10. 1071
  11. 111
  12. 1214
  13. 1314
  14. 146
  15. 1530
  16. 1613
  17. 1727
  18. 1814
  19. 196
  20. 209
  21. 214
  22. 2227
  23. 236
  24. 243
  25. 257
  26. 262
  27. 278
  28. 2812
  29. 2912
All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 4.3
    CVE-2015-5174 EPSS 13%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash d…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 5.3
    CVE-2015-5345 EPSS 18%

    Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

    The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a direc…

    org.apache.tomcat:tomcat tomcat9 tomcat7 tomcat6 Ubuntu Maven
  • Medium 4.3
    CVE-2016-0706

    Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

    Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticate…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven
  • Medium 6.3
    CVE-2016-0763 EPSS 11%

    Improper Verification of Source of a Communication Channel in Apache Tomcat

    The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allow…

    org.apache.tomcat:tomcat tomcat7 tomcat6 Ubuntu Maven