漏洞公告

The Admin UI in Apache Ranger before 0.5.1 does not properly handle authentication requests that lack a password

Apache Tomcat Race Condition vulnerability

The host name verification missing in Apache Tomcat

The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

In Apache Tomcat there is an improper handing of overflow in the UTF-8 decoder

Apache Tomcat information exposure vulnerability

Apache Tomcat unauthorized access vulnerability

Apache Tomcat Open Redirect vulnerability

When running Apache Tomcat on Windows with HTTP PUTs enabled it was possible to upload a JSP file to the server

Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode

In Bouncy Castle JCE Provider the other party DH public key is not fully validated

In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values

In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification

Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

The Bouncy Castle JCE Provider carry a propagation bug

Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate

Deserialization of Untrusted Data in Bouncy castle

Eclipse Vert.x does not properly neutralize '' (forward slashes) sequences that can resolve to an external location

Moderate severity vulnerability that affects io.vertx:vertx-core

Excessive memory allocation

High severity vulnerability that affects io.vertx:vertx-web