Markus Jung

Apache TomEE: Caller identity leaks across requests in embedded HTTP server

Apache TomEE: Session fixation in embedded HTTP server

Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server

Apache TomEE: Well-known administrative credentials created at startup

Apache TomEE: Security constraint bypass via request routing

Apache TomEE: Predictable HTTP session identifiers in embedded server

Apache TomEE: Predictable OpenID Connect state and nonce values

Apache TomEE: Authentication bypass with empty password in LDAP identity store

Apache TomEE: LDAP injection in LDAP identity store

Apache TomEE: Missing authorization on internal deployer EJBs in default profile