Login Request a demo
TO
Product
Tomee
by Apache · last CVE Sep 19, 2021
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities10In the news0Timeline
Severity mix
Critical 4High 3Medium 3Low 0
Severity
All severities10Critical4High3Medium3Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Tomee to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-13931
9.8
4%
Dec 18
If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX…
Affected: 1.0.0 through 1.7.5; 7.0.0 through 7.0.8; 7.1.0 through 7.1.3; 8.0.0 through 8.0.3; 7.0.0; 7.0.0; +2 more
CVE-2020-11969
9.8
4%
Jun 15
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not…
Affected: 1.0.0 through 1.7.5; 7.0.0 through 7.0.7; 7.1.0 through 7.1.2; 8.0.0 through 8.0.1; 7.0.0; 7.0.0; +2 more
CVE-2019-13990
9.8
17%
Jul 26
initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description
Affected: 7.1.3
CVE-2016-0779
9.8
10%
Apr 11
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object
Affected: through 1.7.3; 7.0.0
CVE-2021-40690
7.5
7%
Sep 19
Bypass of the secureValidation property
Affected: before 8.0.8
CVE-2021-30468
7.5
7%
Jun 16
A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an…
Affected: 8.0.6
CVE-2019-17359
7.5
9%
Oct 8
The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data
Affected: 7.0.7; 7.1.2; 8.0.1
CVE-2018-8031
6.1
2%
Jul 23
The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL
Affected: before 7.0.5
CVE-2021-33037
5.3
75%
Jul 12
Incorrect Transfer-Encoding handling with HTTP/1.0
Affected: 8.0.6
CVE-2019-17569
4.8
9%
Feb 24
The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression
Affected: 7.0.7
Showing 10