Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.apache.tomee:tomee-security

4 known vulnerabilities (2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 2 low
Registry
Maven Central

Advisories 4

  • Apache TomEE: Authentication with the stored password digest in Tomcat user identity store

    Affected: from 8.0.0-M2, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.

  • Apache TomEE: Predictable OpenID Connect state and nonce values

    Affected: from 10.0.0-M2, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.

  • Apache TomEE: Authentication bypass with empty password in LDAP identity store

    Affected: from 8.0.4, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.

  • Apache TomEE: LDAP injection in LDAP identity store

    Affected: from 8.0.4, fixed in 10.0.0-M1; from 10.0.0-M1, fixed in 10.3.0; from 11.0.0-M1, fixed in 11.0.0-M2.