Tomee

Vendor:

First CVE: Apr 11, 2017 · Active for 9 years

10

Total CVEs

More Total CVEs than 88% of tracked products

2.0

Avg CVEs / Year

Higher CVE frequency than 60% of tracked products

7.8

Avg CVSS

Higher Avg CVSS than 63% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Tomee over time

Volume of CVEsAvg CVSS Base Score

First CVE

Apr 11, 2017

9 years ago

Most Recent CVE

Sep 19, 2021

1,769 days ago

CVE Severity & Scoring

Tomee10 CVEs

30%

40%

All CVEs352,231 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local0 (0.0%)

Network10 (100.0%)

Unknown0 (0.0%)

Physical0 (0.0%)

Adjacent Network0 (0.0%)

Attack Complexity

Low9 (90.0%)

High1 (10.0%)

Unknown0 (0.0%)

User Interaction

None9 (90.0%)

Unknown0 (0.0%)

Required1 (10.0%)

Privileges Required

Low0 (0.0%)

High0 (0.0%)

None10 (100.0%)

Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (10 CVEs).

10 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2021-33037MEDIUM Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the pos	Jul 12, 2021	5.3	61	NO	NO
CVE-2019-13990CRITICAL initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.	Jul 26, 2019	9.8	40	NO	NO
CVE-2020-13931CRITICAL If Apache TomEE 8.0.0-M1 - 8.0.3, 7.1.0 - 7.1.3, 7.0.0-M1 - 7.0.8, 1.0.0 - 1.7.5 is configured to use the embedded ActiveMQ broker, and the broker config is misconfigured, a JMX po	Dec 18, 2020	9.8	31	NO	NO
CVE-2019-17359HIGH The ASN.1 parser in Bouncy Castle Crypto (aka BC Java) 1.63 can trigger a large attempted memory allocation, and resultant OutOfMemoryError error, via crafted ASN.1 data. This is f	Oct 8, 2019	7.5	29	NO	NO
CVE-2021-40690HIGH All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when crea	Sep 19, 2021	7.5	28	NO	NO
CVE-2016-0779CRITICAL The EjbObjectInputStream class in Apache TomEE before 1.7.4 and 7.x before 7.0.0-M3 allows remote attackers to execute arbitrary code via a crafted serialized object.	Apr 11, 2017	9.8	28	NO	NO
CVE-2021-30468HIGH A vulnerability in the JsonMapObjectReaderWriter of Apache CXF allows an attacker to submit malformed JSON to a web service, which results in the thread getting stuck in an infinit	Jun 16, 2021	7.5	27	NO	NO
CVE-2020-11969CRITICAL If Apache TomEE is configured to use the embedded ActiveMQ broker, and the broker URI includes the useJMX=true parameter, a JMX port is opened on TCP port 1099, which does not incl	Jun 15, 2020	9.8	25	NO	NO
CVE-2019-17569MEDIUM The refactoring present in Apache Tomcat 9.0.28 to 9.0.30, 8.5.48 to 8.5.50 and 7.0.98 to 7.0.99 introduced a regression. The result of the regression was that invalid Transfer-Enc	Feb 24, 2020	4.8	23	NO	NO
CVE-2018-8031MEDIUM The Apache TomEE console (tomee-webapp) has a XSS vulnerability which could allow javascript to be executed if the user is given a malicious URL. This web application is typically	Jul 23, 2018	6.1	21	NO	NO

View all 10 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (10 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (10 CVEs).

Media Mentions

Signals from CVEs in this product scope (10 CVEs).

Top CNAs Publishing CVEs For Tomee

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
8.0.6	2	6.4	41.2%
8.0.1	1	7.5	8.9%
8.0.0	2	9.8	3.9%
7.1.3	1	9.8	16.2%
7.1.2	1	7.5	8.9%
7.0.7	2	6.2	8.9%
7.0.0	3	9.8	4.7%