Markus Jung

Apache TomEE: EJB method authorization is silently skipped on JDK 21+

Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server

Apache TomEE: Missing TLS hostname verification in ejbds client connections

Apache TomEE: Derby network service listens on all interfaces

Apache TomEE: Database credential disclosure via remote JNDI lookup

Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server

Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings

Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications

Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication

Apache TomEE: Path traversal in embedded HTTP server static resource handling