Richard Zowalla

Apache TomEE: Unauthenticated server shutdown via the admin port

Apache TomEE: Authentication bypass via programmatic authentication in embedded HTTP server

Apache TomEE: Unauthenticated LiveReload endpoint reachable from the network

Apache TomEE: Authentication with the stored password digest in Tomcat user identity store

Apache TomEE: Privilege escalation via user name matching a role name

Apache TomEE: HTTP sessions shared across web applications in embedded HTTP server

Apache TomEE: Privilege escalation via WS-Security caller identity leaking between requests

Apache TomEE: Authorization bypass in MicroProfile JWT role checks for JAX-RS resources

Apache TomEE: Expired MicroProfile JWT tokens accepted with negative clock skew

Apache TomEE: Privilege escalation via leaked MicroProfile JWT run-as identity