users  

Messages by Thread

• CVE-2026-111242: Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity Markus Jung via users
• CVE-2026-111240: Apache TomEE: Authentication bypass for accounts without a stored password in SQL login module Markus Jung via users
• CVE-2026-97872: Apache TomEE: Authentication bypass of Hessian EJB endpoints due to ignored security settings Markus Jung via users
• CVE-2026-97874: Apache TomEE: Authentication bypass for Hessian endpoints in non-root web applications Markus Jung via users
• CVE-2026-111247: Apache TomEE: Privilege escalation via user name matching a role name Markus Jung via users
• CVE-2026-111263: Apache TomEE: Missing authentication on EJB web service endpoints deployed in a web application Markus Jung via users
• CVE-2026-97880: Apache TomEE: Authentication bypass in the embedded HTTP server for endpoints protected by HTTP Basic authentication Markus Jung via users
• CVE-2026-111241: Apache TomEE: Local code execution via predictable passivation files in the shared temporary directory Markus Jung via users
• CVE-2026-111264: Apache TomEE: Authentication bypass on EJB web service endpoints via HTTP method Markus Jung via users
• CVE-2026-111261: Apache TomEE: Authentication bypass with empty password in LDAP identity store Markus Jung via users
• CVE-2026-111262: Apache TomEE: LDAP injection in LDAP identity store Markus Jung via users
• CVE-2026-111260: Apache TomEE: Predictable OpenID Connect state and nonce values Markus Jung via users
• CVE-2026-111259: Apache TomEE: Predictable HTTP session identifiers in embedded server Markus Jung via users
• CVE-2026-111257: Apache TomEE: Well-known administrative credentials created at startup Markus Jung via users
• CVE-2026-111258: Apache TomEE: Security constraint bypass via request routing Markus Jung via users
• CVE-2026-111256: Apache TomEE: Missing authentication for web service endpoints in embedded HTTP server Markus Jung via users
• CVE-2026-111249: Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network Markus Jung via users
• CVE-2026-111251: Apache TomEE: Unauthenticated server shutdown via the admin port Markus Jung via users
• CVE-2026-111248: Apache TomEE: Authentication with the stored password digest in Tomcat user identity store Markus Jung via users
• CVE-2026-111250: Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server Markus Jung via users
• CVE-2026-111246: Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server Markus Jung via users
• CVE-2026-111245: Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests Markus Jung via users
• CVE-2026-111244: Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources Markus Jung via users
• CVE-2026-111243: Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew Markus Jung via users
• CVE-2026-97870: Apache TomEE: Missing authentication for Hessian endpoints in embedded HTTP server Markus Jung via users
• CVE-2026-111239: Apache TomEE: Code execution by any authenticated user via the SSH administration shell Markus Jung via users
• CVE-2026-97888: Apache TomEE: Caller identity leaks across requests in embedded HTTP server Markus Jung via users
• CVE-2026-97890: Apache TomEE: Session fixation in embedded HTTP server Markus Jung via users
• CVE-2026-97881: Apache TomEE: Path traversal in embedded HTTP server static resource handling Markus Jung via users
• CVE-2026-87755: Apache TomEE: Stateful session bean hijacking via predictable session identifiers Markus Jung via users
• CVE-2026-87758: Apache TomEE: Missing TLS hostname verification in ejbds client connections Markus Jung via users
• CVE-2026-97849: Apache TomEE: Derby network service listens on all interfaces Markus Jung via users
• CVE-2026-97867: Apache TomEE: Database credential disclosure via remote JNDI lookup Markus Jung via users
• CVE-2026-87756: Apache TomEE: Missing authorization on internal deployer EJBs in default profile Markus Jung via users
• CVE-2026-86811: Apache TomEE: Path traversal via stateful EJB passivation Markus Jung via users
• CVE-2026-86532: Apache TomEE: Username enumeration and timing side channel in JAAS login modules Markus Jung via users
• CVE-2026-86531: Apache TomEE: DoS via unbounded request body and multipart handling in embedded HTTP server Markus Jung via users
• CVE-2026-86336: Apache TomEE: EJB method authorization is silently skipped on JDK 21+ Markus Jung via users
• [ANNOUNCE] TomEE 10.3.0 released jungm.apache.org via users
  • RE: [ANNOUNCE] TomEE 10.3.0 released COURTAULT Francois via users
  • Re: [ANNOUNCE] TomEE 10.3.0 released Richard Zowalla
• [ANNOUNCE] TomEE 11.0.0-M2 released jungm.apache.org via users
• TomEE and CVE-2026-65637 COURTAULT Francois via users
  • Re: TomEE and CVE-2026-65637 Jonathan S. Fisher
  • Re: TomEE and CVE-2026-65637 Richard Zowalla via users
  • Re: TomEE and CVE-2026-65637 Markus Jung via users
  • RE: TomEE and CVE-2026-65637 COURTAULT Francois via users
• [ANN] Apache TomEE 10.2.0 Richard Zowalla
• [ANN] Apache TomEE 11.0.0-M1 Richard Zowalla
  • RE: [ANN] Apache TomEE 11.0.0-M1 benedict
  • RE: [ANN] Apache TomEE 11.0.0-M1 benedict
• Help - Error trying to run Jakarta Rest RSVP example from jakarta ee tutorial. Gabriel Alejandro Soto Rivera
  • Re: Help - Error trying to run Jakarta Rest RSVP example from jakarta ee tutorial. Richard Zowalla
  • Re: Help - Error trying to run Jakarta Rest RSVP example from jakarta ee tutorial. Gabriel Alejandro Soto Rivera
  • Re: Help - Error trying to run Jakarta Rest RSVP example from jakarta ee tutorial. Gabriel Alejandro Soto Rivera
  • Re: Help - Error trying to run Jakarta Rest RSVP example from jakarta ee tutorial. Richard Zowalla
  • Re: Help - Error trying to run Jakarta Rest RSVP example from jakarta ee tutorial. Gabriel Alejandro Soto Rivera
• [ANNOUNCE] Apache TomEE 10.1.5 Markus Jung
  • RE: [ANNOUNCE] Apache TomEE 10.1.5 COURTAULT Francois
  • Re: [ANNOUNCE] Apache TomEE 10.1.5 Richard Zowalla
  • RE: [ANNOUNCE] Apache TomEE 10.1.5 COURTAULT Francois
  • RE: [ANNOUNCE] Apache TomEE 10.1.5 COURTAULT Francois
  • About CVE-2026-34197 and TomEE 10.0.1 COURTAULT Francois
  • Re: About CVE-2026-34197 and TomEE 10.0.1 Richard Zowalla
  • RE: About CVE-2026-34197 and TomEE 10.0.1 COURTAULT Francois
• bcprov-jdk15to18-1.XX, bcutil-jdk15to18-1.XX and bcpkix-jdk15to18-1.XX instead of bcprov-jdk18on-1.XX, bcutil-jdk18on-1.XX and bcpkix-jdk18on-1.XX COURTAULT Francois
  • Re: bcprov-jdk15to18-1.XX, bcutil-jdk15to18-1.XX and bcpkix-jdk15to18-1.XX instead of bcprov-jdk18on-1.XX, bcutil-jdk18on-1.XX and bcpkix-jdk18on-1.XX Markus Jung
• ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider Benedikt Lang
  • Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider Markus Jung
  • Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider Benedikt Lang
  • Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider Markus Jung
  • Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider Benedikt Lang
  • Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider Richard Zowalla
  • Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider Benedikt Lang
  • Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider Markus Jung
  • Re: ContextNotActiveException when using OpenIdAuthenticationMechanism with notifiyProvider Benedikt Lang
• [ANNOUNCE] Apache TomEE 10.1.4 Markus Jung
• [ANNOUNCE] Apache TomEE 10.1.3 Richard Zowalla
• Anyone using SmallRye Reactive Messaging with TomEE? Skander
  • Re: Anyone using SmallRye Reactive Messaging with TomEE? Jonathan S. Fisher
  • Re: Anyone using SmallRye Reactive Messaging with TomEE? Skander
• org.apache.openejb.server.cxf.rs.CxfRsHttpListener Nanjangud Shivakumar Karthik
• EJB deployment issues when migrating to TomEE R Inverid
• [ANNOUNCE] Apache TomEE 10.1.2 Markus Jung
  • Re: [ANNOUNCE] Apache TomEE 10.1.2 Daniel Dias Dos Santos
  • Re: [ANNOUNCE] Apache TomEE 10.1.2 Jean-Louis Monteiro
  • RE: [ANNOUNCE] Apache TomEE 10.1.2 COURTAULT Francois
• TomEE package verification not working COURTAULT Francois
  • Re: TomEE package verification not working Richard Zowalla
  • RE: TomEE package verification not working COURTAULT Francois
  • RE: TomEE package verification not working Richard Zowalla
  • Re: TomEE package verification not working Richard Zowalla
  • RE: TomEE package verification not working COURTAULT Francois
  • RE: TomEE package verification not working Richard Zowalla
  • RE: TomEE package verification not working COURTAULT Francois
  • RE: TomEE package verification not working Richard Zowalla
• [ANNOUNCE] Apache TomEE 10.1.1 Markus Jung
  • RE: [ANNOUNCE] Apache TomEE 10.1.1 COURTAULT Francois
  • RE: [ANNOUNCE] Apache TomEE 10.1.1 Richard Zowalla
  • RE: [ANNOUNCE] Apache TomEE 10.1.1 Richard Zowalla
• Stateless bean injection fails during application server startup Thomas Butz
  • Re: Stateless bean injection fails during application server startup Richard Zowalla
  • Re: Stateless bean injection fails during application server startup Thomas Butz
  • Re: Stateless bean injection fails during application server startup Thomas Butz
• Cannot invoke "org.eclipse.microprofile.auth.LoginConfig.authMethod()" because "loginConfig" is null Java Entwicklung
  • Re: Cannot invoke "org.eclipse.microprofile.auth.LoginConfig.authMethod()" because "loginConfig" is null Richard Zowalla
  • Re: Cannot invoke "org.eclipse.microprofile.auth.LoginConfig.authMethod()" because "loginConfig" is null Java Entwicklung
  • Re: Cannot invoke "org.eclipse.microprofile.auth.LoginConfig.authMethod()" because "loginConfig" is null Richard Zowalla
  • Re: Cannot invoke "org.eclipse.microprofile.auth.LoginConfig.authMethod()" because "loginConfig" is null Java Entwicklung
  • Re: Cannot invoke "org.eclipse.microprofile.auth.LoginConfig.authMethod()" because "loginConfig" is null Richard Zowalla
  • Re: Cannot invoke "org.eclipse.microprofile.auth.LoginConfig.authMethod()" because "loginConfig" is null Java Entwicklung
  • Re: Cannot invoke "org.eclipse.microprofile.auth.LoginConfig.authMethod()" because "loginConfig" is null Richard Zowalla
  • Re: Cannot invoke "org.eclipse.microprofile.auth.LoginConfig.authMethod()" because "loginConfig" is null Java Entwicklung
• Heads-Up: TomEE 10.1.0 / Tomcat 10.1.42 Multipart Request Issues Richard Zowalla
• [ANN] Apache TomEE 10.1.0 Richard Zowalla
  • RE: [ANN] Apache TomEE 10.1.0 COURTAULT Francois
• How to troubleshoot a JWT issue ? COURTAULT Francois
  • Re: How to troubleshoot a JWT issue ? Richard Zowalla
• Problem passing args to tomee.maven.plugin Roar Brænden
  • Re: Problem passing args to tomee.maven.plugin James Pedersen
  • Re: Problem passing args to tomee.maven.plugin James Pedersen
  • Re: Problem passing args to tomee.maven.plugin James Pedersen
  • Re: Problem passing args to tomee.maven.plugin James Pedersen
  • Re: Problem passing args to tomee.maven.plugin James Pedersen
  • Re: Problem passing args to tomee.maven.plugin James Pedersen
  • Re: Problem passing args to tomee.maven.plugin James Pedersen
  • Re: Problem passing args to tomee.maven.plugin James Pedersen
  • Re: Problem passing args to tomee.maven.plugin James Pedersen
  • Re: Problem passing args to tomee.maven.plugin Richard Zowalla
  • Re: Problem passing args to tomee.maven.plugin Roar Brænden
• TomEE 9.1.3 to 10.0.1 issue COURTAULT Francois
  • Re: TomEE 9.1.3 to 10.0.1 issue Richard Zowalla
  • RE: TomEE 9.1.3 to 10.0.1 issue COURTAULT Francois
  • RE: TomEE 9.1.3 to 10.0.1 issue COURTAULT Francois
  • RE: TomEE 9.1.3 to 10.0.1 issue COURTAULT Francois
• Embedded ActiveMQ not starting automatically in TomEE Plus 10? raja shekhar
  • Re: Embedded ActiveMQ not starting automatically in TomEE Plus 10? raja shekhar
  • Re: Embedded ActiveMQ not starting automatically in TomEE Plus 10? raja shekhar
• Roadmap to be compliant with µProfile spec 6.1, 7 ? COURTAULT Francois
  • Re: Roadmap to be compliant with µProfile spec 6.1, 7 ? Richard Zowalla
• Configure Tomcat to use VirtualThread => do we see memory usage decreasing ? COURTAULT Francois
• Invalid character found in the request target TomEE 10.0.1 KARTHIK SHIVAKUMAR
  • Re: Invalid character found in the request target TomEE 10.0.1 Richard Zowalla
  • Re: Invalid character found in the request target TomEE 10.0.1 Nanjangud Shivakumar Karthik
  • Re: Invalid character found in the request target TomEE 10.0.1 Richard Zowalla
  • Re: Invalid character found in the request target TomEE 10.0.1 Nanjangud Shivakumar Karthik
• UUID JSON serialization issue hantsy bai
  • Re: UUID JSON serialization issue Markus Jung
• TomEE does not launch on Java 24 Wolfgang Knauf
  • Re: TomEE does not launch on Java 24 Jean-Louis Monteiro
  • Re: TomEE does not launch on Java 24 Richard Zowalla
  • Re: TomEE does not launch on Java 24 Vicente Rossello
  • Aw: Re: TomEE does not launch on Java 24 Wolfgang Knauf
  • Re: TomEE does not launch on Java 24 Richard Zowalla
  • Re: TomEE does not launch on Java 24 Wolfgang Knauf
  • Re: TomEE does not launch on Java 24 Wolfgang Knauf
  • Re: TomEE does not launch on Java 24 Richard Zowalla
  • Re: TomEE does not launch on Java 24 Wolfgang Knauf
  • Re: TomEE does not launch on Java 24 Richard Zowalla
  • Re: TomEE does not launch on Java 24 Richard Zowalla
  • Re: TomEE does not launch on Java 24 Wolfgang Knauf
  • Re: TomEE does not launch on Java 24 Richard Zowalla
  • Re: TomEE does not launch on Java 24 Richard Zowalla
  • Re: TomEE does not launch on Java 24 Wolfgang Knauf
• [ANN] Apache TomEE 10.0.1 Richard Zowalla
  • Re: [ANN] Apache TomEE 10.0.1 Daniel Dias Dos Santos
  • Re: [ANN] Apache TomEE 10.0.1 hantsy bai
  • Re: [ANN] Apache TomEE 10.0.1 Richard Zowalla
  • Re: [ANN] Apache TomEE 10.0.1 hantsy bai
  • Re: [ANN] Apache TomEE 10.0.1 hantsy bai
  • RE: Re: [ANN] Apache TomEE 10.0.1 Richard Zowalla
  • Re: Re: [ANN] Apache TomEE 10.0.1 hantsy bai
  • Re: [ANN] Apache TomEE 10.0.1 Richard Zowalla
  • RE: JakartaEE Starter Errors (Was: [ANN] Apache TomEE 10.0.1) Richard Zowalla
• Javascript becomes unusable Marco DE BOOIJ
  • Re: Javascript becomes unusable Richard Zowalla
  • Re: Javascript becomes unusable Marco DE BOOIJ
  • Re: Javascript becomes unusable Richard Zowalla
  • Re: Javascript becomes unusable Marco DE BOOIJ
• application-composer example with injected Principal fails to start with enabled logging Egor Duda
  • Re: application-composer example with injected Principal fails to start with enabled logging Richard Zowalla
  • Re: application-composer example with injected Principal fails to start with enabled logging Egor Duda
  • Re: application-composer example with injected Principal fails to start with enabled logging Richard Zowalla
• MP activated or dectivated COURTAULT Francois
  • Re: MP activated or dectivated Richard Zowalla
  • RE: MP activated or dectivated COURTAULT Francois
  • RE: MP activated or dectivated Richard Zowalla
  • RE: MP activated or dectivated COURTAULT Francois
  • Re: MP activated or dectivated Richard Zowalla
  • RE: MP activated or dectivated COURTAULT Francois
• Tomee10 plume - JSF {session} and {request} objects not working Shiryaev, Alexander
  • Re: Tomee10 plume - JSF {session} and {request} objects not working Richard Zowalla
  • RE: Tomee10 plume - JSF {session} and {request} objects not working Shiryaev, Alexander
• Jakarta EE 10 Core TCK certification: when ? COURTAULT Francois
  • Re: Jakarta EE 10 Core TCK certification: when ? Richard Zowalla
• Resolving componentType of compositeComponent on post request Till Gräfenberg
  • Re: Resolving componentType of compositeComponent on post request Richard Zowalla
• Resolution of implicit ELExpressions Till Gräfenberg
  • Re: Resolution of implicit ELExpressions Markus Jung
• Failed to Run Arquillian Tests against Jakarta EE 10 Example hantsy bai

• Earlier messages