CVE-2025-55752

highPriorität · verfolgen · 33EPSS 0.644 · 99. PerzentilExploit · PoCDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

5 exploits · PoC

Likely / severe?

64.4% (99th) EPSS

CVSS 7.5 · high

Is it mine?

117 products

Prüfe deine Angriffsfläche

Who says so?

9 sources

cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · bewertet 2026-10-27

Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSIMATIC CN 4100siemens_psirt
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/
Behobentomcat-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-admin-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-admin-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-docs-webapp-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-docs-webapp-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-el-3_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-el-3_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-javadoc-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-javadoc-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsp-2_3-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsp-2_3-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-lib-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-lib-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-servlet-4_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-servlet-4_0-api-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server 12 SP5-LTSSsuse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-webapps-0:9.0.115-3.160.1.noarch as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-admin-webapps-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-admin-webapps-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-docs-webapp-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-docs-webapp-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-el-3_0-api-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-el-3_0-api-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-embed-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-embed-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-javadoc-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-javadoc-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsp-2_3-api-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsp-2_3-api-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsvc-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsvc-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-lib-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-lib-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-servlet-4_0-api-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-servlet-4_0-api-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-webapps-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-webapps-0:9.0.111-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-admin-webapps-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-admin-webapps-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-doc-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-doc-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-docs-webapp-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-docs-webapp-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-el-5_0-api-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-el-5_0-api-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-embed-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-embed-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-jsp-3_1-api-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-jsp-3_1-api-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-jsvc-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-jsvc-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-lib-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-lib-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-servlet-6_0-api-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-servlet-6_0-api-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-webapps-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-webapps-0:10.1.52-160000.1.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-admin-webapps-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-docs-webapp-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-el-3_0-api-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-embed-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-javadoc-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsp-2_3-api-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-jsvc-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-lib-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-servlet-4_0-api-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat-webapps-0:9.0.111-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-admin-webapps-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-doc-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-docs-webapp-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-el-5_0-api-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-embed-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-jsp-3_1-api-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-jsvc-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-lib-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-servlet-6_0-api-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Behobentomcat10-webapps-0:10.1.52-160000.1.1.noarch as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
BehobenSIMATIC CN 4100cisa_csaf_ot
Update to V5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814144/

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · CISA US

v3.17.5highAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 1.6 · Auswirkung 5.9

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · SUSE Product Security

v3.18.1highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-23USCWE-23USCWE-23USCWE-23USCWE-23USCWE-23US

Exploits (5)

Öffentlicher Proof-of-Concept- und Exploit-Code.

betroffene Produkte (117)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Dell NetWorker 19.14alle Versionencert_bundDEcpe:/a:dell:networker:19.14
IBM FlashSystemalle Versionencert_bundDEcpe:/a:ibm:flashsystem:-
IBM Integration Bus for z/OS 10.1.0.0-10.1.0.6alle Versionencert_bundDEcpe:/a:ibm:integration_bus:for_zos_10.1.0.0_-_10.1.0.6
IBM Power Hardware Management Consolealle Versionencert_bundDEcpe:/a:ibm:hardware_management_console:-
IBM Rational Build Forge 7.0.0.3alle Versionencert_bundDEcpe:/a:ibm:rational_build_forge:7.0.0.3
IBM SAN Volume Controlleralle Versionencert_bundDEcpe:/a:ibm:san_volume_controller:-
IBM Storwizealle Versionencert_bundDEcpe:/a:ibm:storwize:-
Oracle Linuxalle Versionencert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxalle Versionencert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxalle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:-
Red Hat JBoss Web Serveralle Versionencert_bundDEcpe:/a:redhat:jboss_enterprise_web_server:-
SUSE Linuxalle Versionencert_bundDEcpe:/o:suse:suse_linux:-
SUSE openSUSEalle Versionencert_bundDEcpe:/o:suse:opensuse:-
Absolute Secure Access< 14.20cert_bundDE
Apache Tomcat< 10.1.47cert_bundDE
Apache Tomcat< 11.0.12cert_bundDE
Apache Tomcat< 9.0.110cert_bundDE
Dell Networker< 19.13.0.3cert_bundDE

20 von 117 angezeigt

Advisories (16)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2026-0034Kwetsbaarheden verholpen in Atlassian productenNL2026-01-22csaf · ncsc_nlNL
Atlassian heeft kwetsbaarheden verholpen in verschillende producten, welke gebruik maken van Oracle middle-ware producten zoals de Oracle Utilities Application Framework, WebLogic Server, Data Integrator en Business Intelligence Enterprise Edition.
NCSC-2026-0147Kwetsbaarheden verholpen in Siemens-productenNL2026-05-13csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in verschillende (OT-)producten. Het gaat onder andere om producten in de Siemens RUGGEDCOM-, SCALANCE-, SIMATIC-, SIMIT-, SINAMICS-, SIPROTEC-, SENTRON- en Solid Edge-productreeksen.
SSA-032379SSA-032379: Multiple Vulnerabilities in SIMATIC CN 4100 Before V5.02026-05-12csaf · siemens_psirtDE
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
SUSE-SU-2026:1058-1Security update for tomcat2026-03-26csaf · suse_csafDE
Security update for tomcat
SUSE-SU-2026:20084-1Security update for tomcat2026-01-14csaf · suse_csafDE
Security update for tomcat
SUSE-SU-2026:20982-1Security update for tomcat102026-03-30csaf · suse_csafDE
Security update for tomcat10
WID-SEC-W-2025-2420Apache Tomcat: Mehrere SchwachstellenDeutsch2025-10-27csaf · cert_bundDE
Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in Apache Tomcat ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen.
WID-SEC-W-2025-2768SAP Patchday Dezember 2025: Mehrere SchwachstellenDeutsch2025-12-08csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in SAP ausnutzen, um beliebigen Code auszuführen, Systeme zu übernehmen, sensible Daten abzuziehen, interne Ressourcen über SSRF anzusteuern, Dienste zum Absturz zu bringen oder Autorisierungsgrenzen zu umgehen.
WID-SEC-W-2026-0177Atlassian Bamboo, Bitbucket, Confluence und Jira: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, und um einen Cross-Site Scripting Angriff durchzuführen.
WID-SEC-W-2026-0778Dell Secure Connect Gateway Policy Manager: Mehrere SchwachstellenDeutsch2026-03-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Secure Connect Gateway Policy Manager ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
WID-SEC-W-2026-2189Dell PowerProtect Data Domain: Mehrere SchwachstellenDeutsch2026-07-02csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain ausnutzen, um seine Privilegien zu erhöhen um beliebigen Programmcode auszuführen, um Sicherheitsvorkehrungen zu umgehen, um einen Denial of Service Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen, um Informationen offenzulegen, und um Dateien zu manipulieren.
openSUSE-SU-2026:20034-1Security update for tomcat2026-01-14csaf · suse_csafDE
Security update for tomcat
openSUSE-SU-2026:20444-1Security update for tomcat102026-03-30csaf · suse_csafDE
Security update for tomcat10
GHSA-wmwf-9ccg-fff5Apache Tomcat Vulnerable to Relative Path Traversal2025-10-27ghsa · osvUS
The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.
ICSA-26-134-10Siemens SIMATIC2026-05-12icsa · cisa_csaf_otUS
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
BIT-tomcat-2025-55752Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled2025-11-06vendor · osvUS
Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0 through 11.0.10, from 10.1.0 through 10.1.44, from 9.0.0 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

auch bekannt als (6)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu osv cert_bund ncsc_nl siemens_psirt suse_csaf cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2025-10-27geändert 2026-09-23

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog cnnvd
https://tomcat.apache.org/Patchcnnvd
https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1tog enisa_euvd
http://www.openwall.com/lists/oss-security/2025/10/27/4Mailing ListThird Party Advisorynvd
https://cert-portal.siemens.com/productcert/html/ssa-032379.html nvd
https://lists.apache.org/thread/n05kjcwyj1s45ovs8ll1qrrojhfb1togIssue TrackingVendor Advisorynvd
https://www.vicarius.io/vsociety/posts/cve-2025-55752-detect-apache-tomcat-vulnerabilityExploitThird Party Advisorynvd
https://www.vicarius.io/vsociety/posts/cve-2025-55752-mitigate-apache-tomcat-vulnerabilityMitigationThird Party Advisorynvd

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan