The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2599 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    The following packages have been upgraded to a newer upstream version: tomcat (7.0.69). (BZ#1287928)

    Security Fix(es):

    * A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These     applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request     to the root of the web application. This token could then be used by an attacker to perform a CSRF attack.
    (CVE-2015-5351)

    * It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user     to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a     web application that placed a crafted object in a session. (CVE-2016-0714)

    * A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to     access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)

    * A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of     the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file     if the boundary was the typical tens of bytes long. (CVE-2016-3092)

    * A directory traversal flaw was found in Tomcat's RequestUtil.java. A remote, authenticated user could     use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a     pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call.
    (CVE-2015-5174)

    * It was found that Tomcat could reveal the presence of a directory even when that directory was protected     by a security constraint. A user could make a request to a directory via a URL not ending with a slash     and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.
    (CVE-2015-5345)

    * It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a     security manager was configured. This allowed a web application to list all deployed web applications and     expose sensitive information such as session IDs. (CVE-2016-0706)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2016:2045 advisory.

    Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

    Security Fix(es):

    * It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat     initialization script as writeable to the tomcat group. A member of the group or a malicious web     application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

    * It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user     to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a     web application that placed a crafted object in a session. (CVE-2016-0714)

    * It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the     HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client     implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use     this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a     malicious HTTP request. (CVE-2016-5388)

    * A directory traversal flaw was found in Tomcat's RequestUtil.java. A remote, authenticated user could     use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a     pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as     demonstrated by the $CATALINA_BASE/webapps directory. (CVE-2015-5174)

    * It was found that Tomcat could reveal the presence of a directory even when that directory was protected     by a security constraint. A user could make a request to a directory via a URL not ending with a slash     and, depending on whether Tomcat redirected that request, could confirm whether that directory existed.
    (CVE-2015-5345)

    * It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a     security manager was configured. This allowed a web application to list all deployed web applications and     expose sensitive information such as session IDs. (CVE-2016-0706)

    Red Hat would like to thank Scott Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was     discovered by Red Hat Product Security.

    Bug Fix(es):

    * Due to a bug in the tomcat6 spec file, the catalina.out file's md5sum, size, and mtime attributes were     compared to the file's attributes at installation time. Because these attributes change after the service     is started, the rpm -V command previously failed. With this update, the attributes mentioned above are     ignored in the RPM verification and the catalina.out file now passes the verification check. (BZ#1357123)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201705-09 (Apache Tomcat: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Tomcat. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to cause a Denial of Service condition,       obtain sensitive information, bypass protection mechanisms and       authentication restrictions.
    A local attacker, who is a tomcat&rsquo;s system user or belongs to       tomcat&rsquo;s group, could potentially escalate privileges.
  Workaround :

    There is no known workaround at this time.

The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.67, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character. (CVE-2015-5345)

Impact

A remote attacker may be able to determine the existence of restricted directories by exploiting this vulnerability.

BIG-IP/Enterprise Manager

The Tomcat service is not directly exposed to the network, as it only listens on a localhost socket with connections brokered through the Apache front-end web service.

Traffix SDC Exploitation of this vulnerability may occur if an attacker has access to the local network of the system; the Tomcat service is accessible only from the internal network.

According to its self-reported version number, the Apache Tomcat instance listening on the remote host is prior to 9.0.0.M3. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability exists due to     a failure to enforce access restrictions when handling     directory requests that are missing trailing slashes. An     unauthenticated, remote attacker can exploit this to     enumerate valid directories. (CVE-2015-5345)

  - A flaw exists due to a failure to invalidate a previous     session ID when assigning an ID to a new session. An     attacker can exploit this, via a crafted request that     uses the requestedSessionSSL field to fixate the session     ID, to ensure that the user authenticates with a known     session ID, allowing the session to be subsequently     hijacked. (CVE-2015-5346)

  - An information disclosure vulnerability exists in the     Manager and Host Manager web applications due to a flaw     in the index page when issuing redirects in response to     unauthenticated requests for the root directory of the     application. An unauthenticated, remote attacker can     exploit this to gain access to the XSRF token     information stored in the index page. (CVE-2015-5351)

  - An information disclosure vulnerability exists that     allows a specially crafted web application to load the     StatusManagerServlet. An attacker can exploit this to     gain unauthorized access to a list of all deployed     applications and a list of the HTTP request lines for     all requests currently being processed. (CVE-2016-0706)

  - A security bypass vulnerability exists due to a flaw     in the StandardManager, PersistentManager, and cluster     implementations that is triggered when handling     persistent sessions. An unauthenticated, remote attacker     can exploit this, via a crafted object in a session, to     bypass the security manager and execute arbitrary code.
    (CVE-2016-0714)

  - A flaw exists due to the setGlobalContext() method of     ResourceLinkFactory being accessible to web applications     even when run under a security manager. An     unauthenticated, remote attacker can exploit this to     inject malicious global context, allowing data owned by     other web applications to be read or written to.
    (CVE-2016-0763)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Mark Thomas reports :

- CVE-2015-5345 Apache Tomcat Directory disclosure

- CVE-2016-0706 Apache Tomcat Security Manager bypass

- CVE-2016-0714 Apache Tomcat Security Manager Bypass

An update for tomcat6 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es) :

* It was discovered that the Tomcat packages installed certain configuration files read by the Tomcat initialization script as writeable to the tomcat group. A member of the group or a malicious web application deployed on Tomcat could use this flaw to escalate their privileges. (CVE-2016-6325)

* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)

* It was discovered that tomcat used the value of the Proxy header from HTTP requests to initialize the HTTP_PROXY environment variable for CGI scripts, which in turn was incorrectly used by certain HTTP client implementations to configure the proxy for outgoing HTTP requests. A remote attacker could possibly use this flaw to redirect HTTP requests performed by a CGI script to an attacker-controlled proxy via a malicious HTTP request. (CVE-2016-5388)

* A directory traversal flaw was found in Tomcat's RequestUtil.java. A remote, authenticated user could use this flaw to bypass intended SecurityManager restrictions and list a parent directory via a '/..' in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory. (CVE-2015-5174)

* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)

* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured.
This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)

Red Hat would like to thank Scott Geary (VendHQ) for reporting CVE-2016-5388. The CVE-2016-6325 issue was discovered by Red Hat Product Security.

Bug Fix(es) :

* Due to a bug in the tomcat6 spec file, the catalina.out file's md5sum, size, and mtime attributes were compared to the file's attributes at installation time. Because these attributes change after the service is started, the 'rpm -V' command previously failed. With this update, the attributes mentioned above are ignored in the RPM verification and the catalina.out file now passes the verification check. (BZ#1357123)

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-1116:02 advisory.

    Tomcat is the servlet container that is used in the official Reference     Implementation for the Java Servlet and JavaServer Pages technologies.
    The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.
    Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended     to be a collaboration of the best-of-breed developers from around the world.
    Security issues fixed with this release:
    CVE-2015-5174     Directory traversal vulnerability in RequestUtil.java in Apache Tomcat     6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows     remote authenticated users to bypass intended SecurityManager     restrictions and list a parent directory via a /.. (slash dot dot) in     a pathname used by a web application in a getResource,     getResourceAsStream, or getResourcePaths call, as demonstrated by the     $CATALINA_BASE/webapps directory.
    CVE-2015-5345     The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before     7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects     before considering security constraints and Filters, which allows     remote attackers to determine the existence of a directory via a URL     that lacks a trailing / (slash) character.
    CVE-2015-5351     The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x     before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish     sessions and send CSRF tokens for arbitrary new requests, which allows     remote attackers to bypass a CSRF protection mechanism by using a     token.
    CVE-2016-0706     Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31,     and 9.x before 9.0.0.M2 does not place     org.apache.catalina.manager.StatusManagerServlet on the     org/apache/catalina/core/RestrictedServlets.properties list, which     allows remote authenticated users to bypass intended SecurityManager     restrictions and read arbitrary HTTP requests, and consequently     discover session ID values, via a crafted web application.
    CVE-2016-0714     The session-persistence implementation in Apache Tomcat 6.x before     6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2     mishandles session attributes, which allows remote authenticated users     to bypass intended SecurityManager restrictions and execute arbitrary     code in a privileged context via a web application that places a     crafted object in a session.
    CVE-2016-0763     The setGlobalContext method in     org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat     7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not     consider whether ResourceLinkFactory.setGlobalContext callers are     authorized, which allows remote authenticated users to bypass intended     SecurityManager restrictions and read or write to arbitrary     application data, or cause a denial of service (application     disruption), via a web application that sets a crafted global context.
    CVE-2016-3092     The MultipartStream class in Apache Commons Fileupload before 1.3.2,     as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x     before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows     remote attackers to cause a denial of service (CPU consumption) via a     long boundary string.
    The following packages have been upgraded to a newer upstream version: tomcat (7.0.69).
    Additional Changes:

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple security vulnerabilities have been discovered in the Tomcat servlet and JSP engine, which may result in information disclosure, the bypass of CSRF protections and bypass of the SecurityManager.

Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.

Security Fix(es) :

* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)

* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)

* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)

* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)

* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)

* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured.
This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)

Red Hat JBoss Web Server 3.0.3 is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache HTTP Server, the Apache Tomcat Servlet container, Apache Tomcat Connector (mod_jk), JBoss HTTP Connector (mod_cluster), Hibernate, and the Tomcat Native library.

This release of Red Hat JBoss Web Server 3.0.3 serves as a replacement for Red Hat JBoss Web Server 3.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes documented linked to in the References.

Security Fix(es) :

* A session fixation flaw was found in the way Tomcat recycled the requestedSessionSSL field. If at least one web application was configured to use the SSL session ID as the HTTP session ID, an attacker could reuse a previously used session ID for further requests. (CVE-2015-5346)

* A CSRF flaw was found in Tomcat's the index pages for the Manager and Host Manager applications. These applications included a valid CSRF token when issuing a redirect as a result of an unauthenticated request to the root of the web application. This token could then be used by an attacker to perform a CSRF attack. (CVE-2015-5351)

* It was found that several Tomcat session persistence mechanisms could allow a remote, authenticated user to bypass intended SecurityManager restrictions and execute arbitrary code in a privileged context via a web application that placed a crafted object in a session. (CVE-2016-0714)

* A security manager bypass flaw was found in Tomcat that could allow remote, authenticated users to access arbitrary application data, potentially resulting in a denial of service. (CVE-2016-0763)

* It was found that Tomcat could reveal the presence of a directory even when that directory was protected by a security constraint. A user could make a request to a directory via a URL not ending with a slash and, depending on whether Tomcat redirected that request, could confirm whether that directory existed. (CVE-2015-5345)

* It was found that Tomcat allowed the StatusManagerServlet to be loaded by a web application when a security manager was configured.
This allowed a web application to list all deployed web applications and expose sensitive information such as session IDs. (CVE-2016-0706)

The following packages have been upgraded to a newer upstream version:
tomcat (7.0.69).

Security Fix(es) :

  - A CSRF flaw was found in Tomcat's the index pages for     the Manager and Host Manager applications. These     applications included a valid CSRF token when issuing a     redirect as a result of an unauthenticated request to     the root of the web application. This token could then     be used by an attacker to perform a CSRF attack.
    (CVE-2015-5351)

  - It was found that several Tomcat session persistence     mechanisms could allow a remote, authenticated user to     bypass intended SecurityManager restrictions and execute     arbitrary code in a privileged context via a web     application that placed a crafted object in a session.
    (CVE-2016-0714)

  - A security manager bypass flaw was found in Tomcat that     could allow remote, authenticated users to access     arbitrary application data, potentially resulting in a     denial of service. (CVE-2016-0763)

  - A denial of service vulnerability was identified in     Commons FileUpload that occurred when the length of the     multipart boundary was just below the size of the buffer     (4096 bytes) used to read the uploaded file if the     boundary was the typical tens of bytes long.
    (CVE-2016-3092)

  - A directory traversal flaw was found in Tomcat's     RequestUtil.java. A remote, authenticated user could use     this flaw to bypass intended SecurityManager     restrictions and list a parent directory via a '/..' in     a pathname used by a web application in a getResource,     getResourceAsStream, or getResourcePaths call.
    (CVE-2015-5174)

  - It was found that Tomcat could reveal the presence of a     directory even when that directory was protected by a     security constraint. A user could make a request to a     directory via a URL not ending with a slash and,     depending on whether Tomcat redirected that request,     could confirm whether that directory existed.
    (CVE-2015-5345)

  - It was found that Tomcat allowed the     StatusManagerServlet to be loaded by a web application     when a security manager was configured. This allowed a     web application to list all deployed web applications     and expose sensitive information such as session IDs.
    (CVE-2016-0706)

Additional Changes :

Multiple security vulnerabilities have been fixed in the Tomcat servlet and JSP engine, which may result on bypass of security manager restrictions, information disclosure, denial of service or session fixation.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2016-705:03 advisory.

    Tomcat is the servlet container that is used in the official Reference     Implementation for the Java Servlet and JavaServer Pages technologies.
    The Java Servlet and JavaServer Pages specifications are developed by     Sun under the Java Community Process.
    Tomcat is developed in an open and participatory environment and     released under the Apache Software License version 2.0. Tomcat is intended     to be a collaboration of the best-of-breed developers from around the world.
    Security issues fixed with this release:
    CVE-2015-5174     Directory traversal vulnerability in RequestUtil.java in Apache Tomcat     6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows     remote authenticated users to bypass intended SecurityManager     restrictions and list a parent directory via a /.. (slash dot dot) in     a pathname used by a web application in a getResource,     getResourceAsStream, or getResourcePaths call, as demonstrated by the     $CATALINA_BASE/webapps directory.
    CVE-2015-5345     The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before     7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects     before considering security constraints and Filters, which allows     remote attackers to determine the existence of a directory via a URL     that lacks a trailing / (slash) character.
    CVE-2016-0706     Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31,     and 9.x before 9.0.0.M2 does not place     org.apache.catalina.manager.StatusManagerServlet on the     org/apache/catalina/core/RestrictedServlets.properties list, which     allows remote authenticated users to bypass intended SecurityManager     restrictions and read arbitrary HTTP requests, and consequently     discover session ID values, via a crafted web application.
    CVE-2016-0714     The session-persistence implementation in Apache Tomcat 6.x before     6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2     mishandles session attributes, which allows remote authenticated users     to bypass intended SecurityManager restrictions and execute arbitrary     code in a privileged context via a web application that places a     crafted object in a session.
    CVE-2016-5388     Apache Tomcat through 8.5.4, when the CGI Servlet is enabled, follows     RFC 3875 section 4.1.18 and therefore does not protect applications     from the presence of untrusted client data in the HTTP_PROXY     environment variable, which might allow remote attackers to redirect     an application's outbound HTTP traffic to an arbitrary proxy server     via a crafted Proxy header in an HTTP request, aka an httpoxy issue.
    NOTE: the vendor states A mitigation is planned for future releases     of Tomcat, tracked as CVE-2016-5388; in other words, this is not a     CVE ID for a vulnerability.
    CVE-2016-6325
    ** RESERVED **     This candidate has been reserved by an organization or individual that     will use it when announcing a new security problem.  When the     candidate has been publicized, the details for this candidate will be     provided.
    Fixed bugs:
    * Due to a bug in the tomcat6 spec file, the catalina.out file's md5sum, size, and mtime attributes were     compared to the file's attributes at installation time. Because these attributes change after the service     is started, the rpm -V command previously failed. With this update, the attributes mentioned above are     ignored in the RPM verification and the catalina.out file now passes the verification check.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2016-2045 advisory.

    - Resolves: rhbz#1362210 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied     Proxy request header
    - Resolves: rhbz#1367051 CVE-2015-5174 URL Normalization issue
    - Resolves: rhbz#1367054 CVE-2016-0706 Security Manager bypass via StatusManagerServlet
    - Resolves: rhbz#1367058 CVE-2016-0714 Security Manager bypass via persistence mechanisms
    - Resolves: rhbz#1367054 CVE-2015-5345 Directory disclosure

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
94562	RHEL 7 : tomcat (RHSA-2016:2599)	Nessus	Red Hat Local Security Checks	2016/11/4	2025/3/20	high
93950	RHEL 6 : tomcat6 (RHSA-2016:2045)	Nessus	Red Hat Local Security Checks	2016/10/11	2025/3/20	high
100262	GLSA-201705-09 : Apache Tomcat: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/5/18	2025/12/18	critical
107136	F5 Networks BIG-IP : Apache Tomcat 6.x vulnerability (K34341852)	Nessus	F5 Networks Local Security Checks	2018/3/6	2025/10/27	medium
121125	Apache Tomcat < 9.0.0.M3 Multiple Vulnerabilities	Nessus	Web Servers	2019/1/11	2024/5/23	high
89006	FreeBSD : tomcat -- multiple vulnerabilities (1f1124fe-de5c-11e5-8fa8-14dae9d210b8)	Nessus	FreeBSD Local Security Checks	2016/2/29	2021/1/4	high
93965	CentOS 6 : tomcat6 (CESA-2016:2045) (httpoxy)	Nessus	CentOS Local Security Checks	2016/10/12	2026/1/22	high
289429	MiracleLinux 7 : tomcat-7.0.69-10.el7 (AXSA:2016-1116:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
90552	Debian DSA-3552-1 : tomcat7 - security update	Nessus	Debian Local Security Checks	2016/4/18	2021/1/11	high
91245	RHEL 6 : JBoss Web Server (RHSA-2016:1087)	Nessus	Red Hat Local Security Checks	2016/5/19	2021/2/5	high
91246	RHEL 7 : JBoss Web Server (RHSA-2016:1088)	Nessus	Red Hat Local Security Checks	2016/5/19	2021/2/5	high
95863	Scientific Linux Security Update : tomcat on SL7.x (noarch) (20161103)	Nessus	Scientific Linux Local Security Checks	2016/12/15	2026/1/8	high
90205	Debian DSA-3530-1 : tomcat6 - security update	Nessus	Debian Local Security Checks	2016/3/28	2021/1/11	high
289479	MiracleLinux 4 : tomcat6-6.0.24-98.AXS4 (AXSA:2016-705:03)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high
93947	Oracle Linux 6 : tomcat6 (ELSA-2016-2045)	Nessus	Oracle Linux Local Security Checks	2016/10/11	2025/4/29	high

检测

插件搜索

high

high

critical

medium

high

high

high

high

high

high

high

high

high

high

high