https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-12T02:49:51.272682+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2019-17563 CVE-2019-17563 2026-10-12T02:49:51.367748+00:00

Affected: Apache Software Foundation Apache Tomcat

When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.

 https://vulnerability.circl.lu/vuln/usn-4251-1 USN-4251-1 — tomcat8 vulnerabilities 2026-10-12T02:49:51.367894+00:00

Affected: Ubuntu:16.04:LTS: tomcat8

It was discovered that Tomcat incorrectly handled the RMI registry when configured with the JMX Remote Lifecycle Listener. A local attacker could possibly use this issue to obtain credentials and gain complete control over the Tomcat instance. (CVE-2019-12418)

It was discovered that Tomcat incorrectly handled FORM authentication. A remote attacker could possibly use this issue to perform a session fixation attack. (CVE-2019-17563)