Skip to content
OpenAdvisories

Archive

10 August 2017

Vulnerabilities first published on this day (UTC), newest first.

← July 2017 2017 / August /10 September 2017 →
  1. 129
  2. 268
  3. 313
  4. 438
  5. 523
  6. 610
  7. 7118
  8. 8316
  9. 984
  10. 1025
  11. 11100
  12. 12 
  13. 13 
  14. 1420
  15. 156
  16. 1620
  17. 1735
  18. 18176
  19. 195
  20. 205
  21. 2118
  22. 2226
  23. 2333
  24. 2436
  25. 2536
  26. 261
  27. 274
  28. 28104
  29. 2998
  30. 3051
  31. 3142
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • High 7.5
    CVE-2016-6817

    Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat

    The HTTP/2 header parser in Apache Tomcat 9.0.0.M1 to 9.0.0.M11 and 8.5.0 to 8.5.6 entered an infinite loop if a header was received that was larger than the available buffer. This made a denial of service attack possible.

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat Maven
  • High 7.5
    CVE-2016-6797

    Incorrect Authorization in Apache Tomcat

    The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the we…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  • High 7.5
    CVE-2016-8745 EPSS 16%

    Concurrent Execution using Shared Resource with Improper Synchronization in Apache Tomcat

    A bug in the error handling of the send file code for the NIO HTTP connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1 to 8.0.39, 7.0.0 to 7.0.73 and 6.0.16 to 6.0.48 resulted in the current Processor object being added to the Processo…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2016-8739

    Improper Restriction of XML External Entity Reference in Apache CXF JAX-RS

    The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.

    Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  • High 7.5
    CVE-2017-3156

    Covert Timing Channel in Apache CXF

    The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

    Apache Software Foundation Apache CXF org.apache.cxf.karaf:apache-cxf Maven