Approved changes feed: RSS · Atom
cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Tomee (a1d825c0-075a-574e-84ab-ddaa4793fe75) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/tomee |
purl2cpe | 2026-06-01 10:14:24.402274 |
pkg:github/apache/tomee |
purl2cpe | 2026-06-01 10:14:24.402278 |
pkg:maven/org.apache.tomee/tomee |
purl2cpe | 2026-06-01 10:14:24.402280 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-40690 |
vulnerable | 2026-06-08 05:35:18.900701 |
Bypass of the secureValidation property
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Published: 2021-09-19T00:00:00.000Z
Updated: 2024-08-04T02:51:06.487Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-13931 |
vulnerable | 2026-06-08 05:18:01.390641 |
Details available
If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.
Published: 2020-12-17T23:42:39.000Z
Updated: 2024-08-04T12:32:14.285Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-11969 |
vulnerable | 2026-06-08 05:17:55.885485 |
Details available
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
Published: 2020-06-15T19:03:49.000Z
Updated: 2024-08-04T11:48:56.988Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-8031 |
vulnerable | 2026-06-08 05:12:05.029933 |
Details available
The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this application included. This issue can be mitigated by removing the application after TomEE is setup (if using the application to install TomEE), using one of the provided pre-configured bundles, or by upgrading to TomEE 7.0.5. This issue is resolve in this commit: b8bbf50c23ce97dd64f3a5d77f78f84e47579863.
Published: 2018-07-23T22:00:00.000Z
Updated: 2024-09-16T17:58:50.281Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-0779 |
vulnerable | 2026-06-08 05:07:16.239031 |
Details available
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
Published: 2017-04-11T16:00:00.000Z
Updated: 2024-08-05T22:30:04.196Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.