CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2011-1183
https://notcve.org/view.php?id=CVE-2011-1183
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419. Apache Tomcat v7.0.11, cuando web.xml no tiene configuración de login, no se siguen las restricciones de seguridad, permitiendo a atacantes remotos evitar las restricciones de acceso a través de peticiones HTTP a los meta-datos de la aplicación web. NOTA: esta vulnerabilidad existe debido a un parche incorrecto para CVE-2011-1088 y CVE-2011-1419. • http://seclists.org/fulldisclosure/2011/Apr/96 http://securityreason.com/securityalert/8187 http://svn.apache.org/viewvc?view=revision&revision=1087643 http://tomcat.apache.org/security-7.html http://www.securityfocus.com/archive/1/517362/100/0/threaded http://www.securityfocus.com/bid/47196 https://exchange.xforce.ibmcloud.com/vulnerabilities/66675 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12701 •
CVSS: 5.8EPSS: 0%CPEs: 11EXPL: 0CVE-2011-1088
https://notcve.org/view.php?id=CVE-2011-1088
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. Apache Tomcat v7.x anterior a v7.0.10 no sigue anotaciones ServletSecurity, lo que permite a atacantes remotos evitar las restricciones de acceso a través de peticiones HTTP a una aplicación web. • http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E http://markmail.org/message/lzx5273wsgl5pob6 http://markmail.org/message/yzmyn44f5aetmm2r http://secunia.com/advisories/43684 http://svn.apache.org/viewvc?view=revision&revision=1076586 http://svn.apache.org/viewvc?view=revision&revision=1076587 http://svn.apache.org/viewvc?view=revision&revision=1077995 http://tomcat.apache.org/security-7.html http://www.osvdb.org/71027 http://www.securi •
CVSS: 5.8EPSS: 0%CPEs: 12EXPL: 0CVE-2011-1419
https://notcve.org/view.php?id=CVE-2011-1419
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088. Apache Tomcat v7.x anterior a v7.0.11, cuando web.xml no tiene restricciones de seguridad, no sigue anotaciones ServletSecurity, lo que permite a atacantes remotos evitar las restricciones de acceso a través de peticiones HTTP a una aplicación web. Nota: esta vulnerabilidad existe debido a un parche incompleto para CVE-2011-1088. • http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E http://marc.info/?l=tomcat-user&m=129966773405409&w=2 http://markmail.org/message/lzx5273wsgl5pob6 http://markmail.org/message/yzmyn44f5aetmm2r http://secunia.com/advisories/43684 http://securityreason.com/securityalert/8131 http://svn.apache.org/viewvc?view=revision&revision=1079752 http://tomcat.apache.org/security-7.html http://www.osvdb.org/71027 http://www.securityfocus.com/bid •
CVSS: 4.3EPSS: 0%CPEs: 65EXPL: 1CVE-2011-0013 – tomcat: XSS vulnerability in HTML Manager interface
https://notcve.org/view.php?id=CVE-2011-0013
Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en la interfaz de HTML Manager en Apache Software Foundation Tomcat v7.0 antes de v7.0.6, v5.5 antes de v5.5.32 y v6.0 antes de v6.0.30 permiten a atacantes remotos inyectar secuencias de comandos web o HTML, como se demuestra a través de una etiqueta display-name. Apache Tomcat Manager suffers from a cross site scripting vulnerability. Versions 7.0.0 through 7.0.5, 6.0.0 through 6.0.29, and 5.5.0 through 5.5.31 are affected. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://marc.info/?l=bugtraq&m=130168502603566&w=2 http://marc.info/?l=bugtraq&m=132215163318824&w=2 http://marc.info/?l=bugtraq&m=136485229118404&w=2 http://marc.info/?l=bugtraq&m=139344343412337&w=2 http://secunia.com/advisories/43192 http://secunia.com/advisories/45022 http://secunia.com/advisories/57126 http://s • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 1%CPEs: 34EXPL: 0CVE-2011-0534 – tomcat: remote DoS via NIO connector
https://notcve.org/view.php?id=CVE-2011-0534
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request. Apache Tomcat v7.0.0 hasta v7.0.6 y v6.0.0 hasta v6.0.30 no hace cumplir el límite maxHttpHeaderSize de las solicitudes relacionadas con el conector NIO HTTP, que permite a atacantes remotos provocar una denegación de servicio (OutOfMemoryError) a través de una solicitud manipulada. • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://marc.info/?l=bugtraq&m=139344343412337&w=2 http://osvdb.org/70809 http://secunia.com/advisories/43192 http://secunia.com/advisories/45022 http://secunia.com/advisories/57126 http://securityreason.com/securityalert/8074 http://support.apple.com/kb/HT5002 http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5098 • CWE-399: Resource Management Errors •