The Apache Software Foundation

Apache TomEE: Predictable OpenID Connect state and nonce values

Apache TomEE: Authentication bypass with empty password in LDAP identity store

Apache TomEE: LDAP injection in LDAP identity store

Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application

Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method

Apache TomEE: Missing authorization on internal deployer EJBs in default profile

Apache TomEE: Stateful session bean hijacking via predictable session identifiers

Apache TomEE: Path traversal via stateful EJB passivation

Apache TomEE: Username enumeration and timing side channel in JAAS login modules

Apache Sling Engine: Request-derived values reach log sinks without CR/LF neutralization