Apache TomEE at a glance
- Last 12 months
- 38
- Critical · all time
- 0
- Exploited · all time
- 0
- Public exploit · all time
- 0
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 38 | 0 |
| Oct 2026 | 0 | 0 |
| Sep 2026 | 0 | 0 |
| Aug 2026 | 0 | 0 |
| Jul 2026 | 0 | 0 |
| Jun 2026 | 0 | 0 |
| May 2026 | 0 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 0 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 0 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 0 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 0 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
39 results · Feed
-
Unscored —
Apache TomEE: EJB method authorization is silently skipped on JDK 21+
Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access restrictions being enforced. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the iss…
-
Unscored —
The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does …
-
Unscored —
The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certifica…
-
Unscored —
The embedded Derby network service ignores its configured bind address and listens on all network interfaces. When the …
-
Unscored —
The EJBd remote protocol returns datasource connection details, including database credentials, to remote clients that …
-
Unscored —
When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transport securit…
-
Unscored —
When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured authentic…
-
Unscored —
When Hessian remoting is configured with BASIC authentication, the authentication check is not applied to Hessian endpo…
-
Unscored —
The embedded OpenEJB HTTP server dispatches some requests to REST endpoints configured for HTTP Basic authentication wi…
-
Unscored —
The embedded OpenEJB HTTP server does not restrict static resource paths to the configured resource directories. A remo…
-
Unscored —
The embedded HTTP server does not clear the security identity established during a request before its worker thread han…
-
Unscored —
The embedded HTTP server does not invalidate the previous session identifier when an application changes the session id…
-
Unscored —
Apache TomEE: Code execution by any authenticated user via the SSH administration shell
The optional SSH administration service grants full access to the administration shell to every user that authenticates against its configured login domain, without checking for an administrative role. An attacker holding the credentials of any user in that d…
-
Unscored —
The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL. A remot…
-
Unscored —
When a non-default stateful session bean passivation strategy is configured, passivated bean state is written to predic…
-
Unscored —
When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state establishe…
-
Unscored —
A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and othe…
-
Unscored —
When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enfo…
-
Unscored —
After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the worker threa…
-
Unscored —
The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker can use a s…
-
Unscored —
When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a role name in…
-
Unscored —
The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the stored v…
-
Unscored —
The development-time LiveReload support listens on all network interfaces without authentication and accepts websocket …
-
Unscored —
The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication pro…
-
Unscored —
The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or …
-
Unscored —
When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured a…
-
Unscored —
With the default configuration and no users defined in the default user database, TomEE silently adds an administrative…
-
Unscored —
The optional request routing feature forwards requests to their configured destination without applying the security co…
-
Unscored —
The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A r…
-
Unscored —
The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptograp…
-
Unscored —
The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthentica…
-
Unscored —
Apache TomEE: LDAP injection in LDAP identity store
The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influe…
-
Unscored —
Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application
Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the appl…
-
Unscored —
Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method
The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgra…
-
Unscored —
Apache TomEE: Missing authorization on internal deployer EJBs in default profile
The internal system EJBs used for remote deployment and configuration did not enforce their administrative role check when the server ran with the default profile. A remote unauthenticated attacker able to reach the remote EJB endpoint could deploy arbitrary …
-
Unscored —
Apache TomEE: Stateful session bean hijacking via predictable session identifiers
Stateful session bean identifiers are not generated from a cryptographically secure random source. A remote attacker with access to the EJB remote endpoint who holds one valid identifier can derive those of other clients' sessions and invoke methods on their …
-
Unscored —
Apache TomEE: Path traversal via stateful EJB passivation
The stateful session bean passivation mechanism derives the on-disk file name from a client-supplied identifier without validating it. A remote attacker with access to the remote EJB service can cause session state to be read from or written to files outside …
-
Unscored —
Apache TomEE: Username enumeration and timing side channel in JAAS login modules
The bundled JAAS login modules leak whether a username exists and compare credentials in a non-constant-time manner. A remote unauthenticated attacker can enumerate valid accounts and may infer credential material through timing analysis. Users are recommende…
-
Medium 6.1
Apache TomEE console vulnerable to Cross-site Scripting
The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not s…