Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2Apache Solr DataImportHandler Code Injection VulnerabilityPatch nowKEVEPSS 83.55%Aug 1, 2019
- High7.8Apache HTTP Server Privilege Escalation VulnerabilityPatch nowKEVEPSS 65.00%Apr 8, 2019
- Medium4.3When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g.Check this weekEPSS 97.68%Oct 4, 2018
- High8.1Apache Struts Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.99%Aug 22, 2018
- Medium5.4In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a m…Check if you run itEPSS 4.80%Jul 26, 2018
- Critical9.8The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable '…Check this weekEPSS 21.31%May 16, 2018
- UnknownGNU Bourne-Again Shell (Bash) Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 64.33%Mar 1, 2018
- Medium5.9The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC…Check this weekEPSS 17.07%Feb 28, 2018
- Medium6.5Security constraints defined by annotations of Servlets in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 were only applied…Check this weekEPSS 14.47%Feb 23, 2018
- High8.1Apache Tomcat Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.97%Oct 3, 2017
- High7.5When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources serv…Check this weekEPSS 70.12%Sep 19, 2017
- High8.1Apache Tomcat on Windows Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.64%Sep 19, 2017
- High8.1Apache Struts Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 99.40%Sep 15, 2017
- Medium4.3The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44 and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the r…Check if you run itEPSS 8.04%Aug 11, 2017
- Medium5.3When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager.Check if you run itEPSS 7.15%Aug 10, 2017
- Critical9.8Apache Struts 1 Improper Input Validation VulnerabilityPatch nowKEVEPSS 98.91%Jul 10, 2017
- High7.5The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the origina…Check this weekEPSS 16.57%Jun 6, 2017
- Critical9.8Adobe ColdFusion Deserialization VulnerabilityPatch nowKEVEPSS 90.60%Apr 27, 2017
- Critical9.1While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, an…Check this weekEPSS 13.23%Apr 17, 2017
- Critical9.8Apache Tomcat Remote Code Execution VulnerabilityPatch nowKEVEPSS 90.34%Apr 6, 2017
- Critical9.8Apache Struts Remote Code Execution VulnerabilityPatch nowKEVEPSS 100.00%Mar 10, 2017
- High8.1Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications fr…Check this weekEPSS 50.90%Jul 19, 2016
- High8.2ActionServlet.java in Apache Struts 1 1.x through 1.3.10 does not properly restrict the Validator configuration, which allows remote attackers to conduct cross-site sc…Check this weekEPSS 25.74%Jul 4, 2016
- High8.1ActionServlet.java in Apache Struts 1 1.x through 1.3.10 mishandles multithreaded access to an ActionForm instance, which allows remote attackers to execute arbitrary…Check this weekEPSS 13.12%Jul 4, 2016
- Critical9.8Apache Shiro Code Execution VulnerabilityPatch nowKEVEPSS 93.04%Jun 7, 2016