CVE-2009-0783

tomcat XML parser information disclosure

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.

CVSS 3.0 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Application Platform and 4 more

CVE-2006-7195

tomcat XSS in example webapps

Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.

CVSS 2.0 · 4.3 Medium EPSS 5.5% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Network Satellite and 2 more

CVE-2007-0450

tomcat directory traversal

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

CVSS 2.0 · 5.0 Medium EPSS 91.2% KEV · Not listed

Vendors

Apache Redhat

Products

Http Server Tomcat Certificate System and 5 more

CVE-2007-1358

tomcat accept-language xss flaw

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CVSS 2.0 · 2.6 Low EPSS 19.9% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2007-3382

tomcat handling of cookies

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.

CVSS 2.0 · 4.3 Medium EPSS 37.5% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2007-3385

tomcat handling of cookie values

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.

CVSS 2.0 · 4.3 Medium EPSS 16.9% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2007-5333

Improve cookie parsing for tomcat5

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.

CVSS 2.0 · 5.0 Medium EPSS 62.6% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2007-5342

Apache Tomcat's default security policy is too open

The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.

CVSS 2.0 · 6.4 Medium EPSS 5.2% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Application Platform and 2 more

CVE-2007-5461

Absolute path traversal Apache Tomcat WEBDAV

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CVSS 2.0 · 3.5 Low EPSS 39.7% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 5 more

CVE-2008-1232

tomcat: Cross-Site-Scripting enabled by sendError call

Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.

CVSS 2.0 · 4.3 Medium EPSS 75.9% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2008-1947

Tomcat host manager xss - name field

Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.

CVSS 2.0 · 4.3 Medium EPSS 9.8% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Network Satellite and 2 more

CVE-2008-2370

tomcat RequestDispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

CVSS 2.0 · 5.0 Medium EPSS 52.7% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2008-2938

tomcat Unicode directory traversal vulnerability

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

CVSS 2.0 · 4.3 Medium EPSS 99.7% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Enterprise Linux Jboss Enterprise Application Platform and 3 more

CVE-2008-5515

tomcat request dispatcher information disclosure vulnerability

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.

CVSS 2.0 · 5.0 Medium EPSS 18.7% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 5 more

CVE-2009-0033

tomcat6 Denial-Of-Service with AJP connection

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.

CVSS 2.0 · 5.0 Medium EPSS 10.1% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2009-0580

tomcat6 Information disclosure in authentication classes

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.

CVSS 2.0 · 4.3 Medium EPSS 94.4% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 5 more

CVE-2005-2090

tomcat multiple content-length header poisioning

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."

CVSS 2.0 · 4.3 Medium EPSS 26.1% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more

CVE-2010-2227

tomcat: information leak vulnerability in the handling of 'Transfer-Encoding' header

Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer."

CVSS 2.0 · 6.4 Medium EPSS 54.8% KEV · Not listed

Vendors

Apache Redhat

Products

Tomcat Certificate System Enterprise Linux and 4 more