CVE-2012-4431
org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to by
CVSS
4.3
Sem CVSS
EPSS
9.1%
p95
KEV
—
Exploit Today
29
0-100
Publicado: 19 de dez. de 2012 · Última mod.: 9 de out. de 2026 · CWE-264
9.1%EPSS · 30 dias9.1%
2026-10-142026-11-11
org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers to bypass the cross-site request forgery (CSRF) protection mechanism via a request that lacks a session identifier.
- archives.neohapsis.comhttp://archives.neohapsis.com/archives/bugtraq/2012-12/0045.html
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2012-12/msg00090.html
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2013-01/msg00037.html
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2013-01/msg00051.html
- lists.opensuse.orghttp://lists.opensuse.org/opensuse-updates/2013-01/msg00080.html
- marc.infohttp://marc.info/?l=bugtraq&m=136612293908376&w=2
- marc.infohttp://marc.info/?l=bugtraq&m=139344343412337&w=2
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0267.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0268.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0647.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-0648.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1437.html
- rhn.redhat.comhttp://rhn.redhat.com/errata/RHSA-2013-1853.html
- secunia.comhttp://secunia.com/advisories/57126
- svn.apache.orghttp://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/java/org/apache/catalina/filters/CsrfPreventionFilter.java?r1=1393088&r2=1393087&pathrev=1393088
- svn.apache.orghttp://svn.apache.org/viewvc/tomcat/tc7.0.x/trunk/webapps/docs/changelog.xml?r1=1393088&r2=1393087&pathrev=1393088
- svn.apache.orghttp://svn.apache.org/viewvc?view=revision&revision=1393088
- tomcat.apache.orghttp://tomcat.apache.org/security-6.html
- tomcat.apache.orghttp://tomcat.apache.org/security-7.html
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1011845.5 MÉD0.1%
——0Permission control vulnerability in the Bluetooth module.
Impact: Successful exploitation of this vulnerability may affect availability.10dCVE-2026-1011773.7 BAI3.9%
——1Permission control vulnerability in the Optimizer module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.10dCVE-2026-1011767.1 ALT2.9%
——1Permission control vulnerability in the event notification management module.
Impact: Successful exploitation of this vulnerability may affect service confidentiality.10dCVE-2026-1011726.2 MÉD0.5%
——0Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.10dCVE-2026-1011713.6 BAI0.3%
——0Permission control vulnerability in the background task management module.
Impact: Successful exploitation of this vulnerability may affect service integrity.10dCVE-2026-1163676.3 MÉD22.3%
——7A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.10d