CVE Watchtower

Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attack...

The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS certificate. An attacker able to in...

The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, and does not remove the temporary files ...

Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB methods without the configured access re...

A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative pr...

An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a loca...

SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated attacker to achieve remote code execution...

A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_libs (version(s): 0.14.5). A specially cr...

A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(s): 0.7.3). A specially crafted .mp3 fil...

Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitrary trusted...

The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory...

The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and...

The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a s...

The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination o...

With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known passwor...

When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some configured authentication methods are silen...

The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local user or process able to connect to the ...

When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not always enforced as declared: resources tha...

A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration and other time-based claims. In such co...

The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentication programmatically. A remote unauthe...