CVE-2012-5886
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches i
CVSS
5.0
Sin CVSS
EPSS
8.8%
p95
KEV
—
Exploit Today
29
0-100
Publicado: 17 nov 2012 · Última mod.: 9 oct 2026 · CWE-287
8.8%EPSS · 30 días8.8%
2026-10-012026-10-28
The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0623.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0629.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0631.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0632.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0633.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0640.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0647.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0648.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0726.html
- secunia.comhttp://secunia.com/advisories/51371
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1377807
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1380829
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1392248
- tomcat.apache.orghttp://tomcat.apache.org/security-5.html
- tomcat.apache.orghttp://tomcat.apache.org/security-6.html
- tomcat.apache.orghttp://tomcat.apache.org/security-7.html
- www-01.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21626891
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1189595.4 MED—
———A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user, such as profile verification or terms and conditions. Due to incorrect handling of application-initiated actions, Keycloak may skip these mandatory challenges and issue an authorization code. This can allow a user to bypass administrative requirements and gain access to the application without completing necessary profile updates or agreeing to terms.6hCVE-2026-1070589.8 CRÍ—
———An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service API and preference state.11hCVE-2026-936809.8 CRÍ—
———IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.3hCVE-2026-908624.3 MED—
———Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an attacker with a user’s password to access certain files associated with that account without satisfying multi-factor authentication requirements.15hCVE-2026-842966.8 MED—
———Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of authentication factors between accounts.3hCVE-2026-8429510.0 CRÍ—
———Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.3h