WaratekVRT Sign in

High Oracle Database Server Workload Manager (Apache Tomcat) CVEs

3 CVEs

Reset
More filters (1)
Columns
Oracle product: Oracle Database Server / Workload Manager (Apache Tomcat)✕
Overview 3 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
3matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC33.3% 2EPSS ≥ 0.566.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 2 66.7%
Critical 0 0.0% High 3 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 33.3% Proof of concept only 0 0.0% Forecast only 1 33.3% No public exploit 1 33.3%
split by peak 1 / quarter
No exploit published: 2Mitigation candidate: 1 High: 3 not blocked: 3 No public exploit: 1Forecast only: 1Working exploit published: 1
Q2 191 No exploit published1 High1 not blocked1 Forecast only1 Q3 190 Q4 190 Q1 200 Q2 200 Q3 201 Mitigation candidate1 High1 not blocked1 Working exploit published1 Q4 201 No exploit published1 High1 not blocked1 No public exploit1
Q2 19Q3 19Q4 19Q1 20Q2 20Q3 20Q4 20
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-17527 High 2020-12-03 No exploit published No public exploit While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
CVE-2020-13935 High 2020-07-14 Mitigation candidate Working exploit published The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
CVE-2019-10072 High 2019-06-21 No exploit published Forecast only The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.