Approved changes feed: RSS · Atom

cpe:2.3:a:apache:tomee:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorApache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95)
ProductTomee (a1d825c0-075a-574e-84ab-ddaa4793fe75)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:apache/tomee purl2cpe 2026-06-01 10:14:24.402274
pkg:github/apache/tomee purl2cpe 2026-06-01 10:14:24.402278
pkg:maven/org.apache.tomee/tomee purl2cpe 2026-06-01 10:14:24.402280

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-40690 vulnerable 2026-06-08 05:35:18.900701 Bypass of the secureValidation property
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract any local .xml files in a RetrievalMethod element.
Published: 2021-09-19T00:00:00.000Z
Updated: 2024-08-04T02:51:06.487Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-13931 vulnerable 2026-06-08 05:18:01.390641 Details available
If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX port is opened on TCP port 1099, which does not include authentication. CVE-2020-11969 previously addressed the creation of the JMX management interface, however the incomplete fix did not cover this edge case.
Published: 2020-12-17T23:42:39.000Z
Updated: 2024-08-04T12:32:14.285Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-11969 vulnerable 2026-06-08 05:17:55.885485 Details available
If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not include authentication. This affects Apache TomEE 8.0.0-M1 - 8.0.1, Apache TomEE 7.1.0 - 7.1.2, Apache TomEE 7.0.0-M1 - 7.0.7, Apache TomEE 1.0.0 - 1.7.5.
Published: 2020-06-15T19:03:49.000Z
Updated: 2024-08-04T11:48:56.988Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-8031 vulnerable 2026-06-08 05:12:05.029933 Details available
The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically used to add TomEE features to a Tomcat installation. The TomEE bundles do not ship with this application included. This issue can be mitigated by removing the application after TomEE is setup (if using the application to install TomEE), using one of the provided pre-configured bundles, or by upgrading to TomEE 7.0.5. This issue is resolve in this commit: b8bbf50c23ce97dd64f3a5d77f78f84e47579863.
Published: 2018-07-23T22:00:00.000Z
Updated: 2024-09-16T17:58:50.281Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2016-0779 vulnerable 2026-06-08 05:07:16.239031 Details available
The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.
Published: 2017-04-11T16:00:00.000Z
Updated: 2024-08-05T22:30:04.196Z
Reference links
Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.