FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The VUXML data was last processed by FreshPorts on 2024-03-27 18:04:16 UTC

List all Vulnerabilities, by package

List all Vulnerabilities, by date

k68

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
556fdf03-6785-11ed-953b-002b67dfc673Tomcat -- Request Smuggling

Apache Tomcat reports:

If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

The CVSS score for this vulnerability is 7.5 High


Discovery 2022-10-31
Entry 2022-11-18
tomcat
ge 8.5.0 lt 8.5.83

ge 9.0.0-M1 lt 9.0.68

ge 10.0.0-M1 lt 10.0.27

ge 10.1.0-M1 lt 10.1.1

tomcat85
ge 8.5.0 lt 8.5.83

tomcat9
ge 9.0.0-M1 lt 9.0.68

tomcat10
ge 10.0.0-M1 lt 10.0.27

tomcat101
ge 10.1.0-M1 lt 10.1.1

tomcat-devel
ge 10.1.0-M1 lt 10.1.1

CVE-2022-42252
https://nvd.nist.gov/vuln/detail/CVE-2022-42252
556fdf03-6785-11ed-953b-002b67dfc673Tomcat -- Request Smuggling

Apache Tomcat reports:

If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

The CVSS score for this vulnerability is 7.5 High


Discovery 2022-10-31
Entry 2022-11-18
tomcat
ge 8.5.0 lt 8.5.83

ge 9.0.0-M1 lt 9.0.68

ge 10.0.0-M1 lt 10.0.27

ge 10.1.0-M1 lt 10.1.1

tomcat85
ge 8.5.0 lt 8.5.83

tomcat9
ge 9.0.0-M1 lt 9.0.68

tomcat10
ge 10.0.0-M1 lt 10.0.27

tomcat101
ge 10.1.0-M1 lt 10.1.1

tomcat-devel
ge 10.1.0-M1 lt 10.1.1

CVE-2022-42252
https://nvd.nist.gov/vuln/detail/CVE-2022-42252
3ae106e2-d521-11e6-ae1b-002590263bf5tomcat -- multiple vulnerabilities

The Apache Software Foundation reports:

Low: Unrestricted Access to Global Resources CVE-2016-6797

Low: Security Manager Bypass CVE-2016-6796

Low: System Property Disclosure CVE-2016-6794

Low: Security Manager Bypass CVE-2016-5018

Low: Timing Attack CVE-2016-0762


Discovery 2016-10-27
Entry 2017-01-07
Modified 2017-03-18
tomcat
< 6.0.47

tomcat7
< 7.0.72

tomcat8
< 8.0.37

CVE-2016-6797
CVE-2016-6796
CVE-2016-6794
CVE-2016-5018
CVE-2016-0762
http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37
556fdf03-6785-11ed-953b-002b67dfc673Tomcat -- Request Smuggling

Apache Tomcat reports:

If Tomcat was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to false (the default for 8.5.x only), Tomcat did not reject a request containing an invalid Content-Length header making a request smuggling attack possible if Tomcat was located behind a reverse proxy that also failed to reject the request with the invalid header.

The CVSS score for this vulnerability is 7.5 High


Discovery 2022-10-31
Entry 2022-11-18
tomcat
ge 8.5.0 lt 8.5.83

ge 9.0.0-M1 lt 9.0.68

ge 10.0.0-M1 lt 10.0.27

ge 10.1.0-M1 lt 10.1.1

tomcat85
ge 8.5.0 lt 8.5.83

tomcat9
ge 9.0.0-M1 lt 9.0.68

tomcat10
ge 10.0.0-M1 lt 10.0.27

tomcat101
ge 10.1.0-M1 lt 10.1.1

tomcat-devel
ge 10.1.0-M1 lt 10.1.1

CVE-2022-42252
https://nvd.nist.gov/vuln/detail/CVE-2022-42252
e5ec2767-d529-11e6-ae1b-002590263bf5tomcat -- information disclosure vulnerability

The Apache Software Foundation reports:

Important: Information Disclosure CVE-2016-8745


Discovery 2017-01-05
Entry 2017-01-07
Modified 2017-03-18
tomcat
< 6.0.49

tomcat7
< 7.0.74

tomcat8
< 8.0.40

CVE-2016-8745
ports/215865
http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.49
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.74
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.40
0b9af110-d529-11e6-ae1b-002590263bf5tomcat -- multiple vulnerabilities

The Apache Software Foundation reports:

Important: Remote Code Execution CVE-2016-8735

Important: Information Disclosure CVE-2016-6816


Discovery 2016-11-22
Entry 2017-01-07
Modified 2017-03-18
tomcat
< 6.0.48

tomcat7
< 7.0.73

tomcat8
< 8.0.39

CVE-2016-8735
CVE-2016-6816
ports/214599
http://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.48
http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.73
http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.39
e2e7faf9-1b51-11ed-ae46-002b67dfc673Tomcat -- XSS in examples web application

Apache Tomcat reports:

The Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.


Discovery 2022-06-22
Entry 2022-08-14
tomcat
ge 8.5.50 lt 8.5.81

ge 9.0.30 lt 9.0.64

ge 10.0.0-M1 lt 10.0.22

ge 10.1.0-M1 lt 10.1.0-M16

tomcat85
ge 8.5.50 lt 8.5.81

tomcat9
ge 9.0.30 lt 9.0.64

tomcat10
ge 10.0.0-M1 lt 10.0.22

tomcat-devel
ge 10.1.0-M1 lt 10.1.0-M16

CVE-2022-34305
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34305