CVSS: 7.5EPSS: 6%CPEs: 10EXPL: 0CVE-2002-1394
https://notcve.org/view.php?id=CVE-2002-1394
17 Jan 2003 — Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148. Apache Tomcat 4.0.5 y anteriores, cuando usando el servlet invocador y el servlet por defecto, permite a atacantes remotos leer código fuente de ficheros del servidor o evadir ciertas protecciones, una variante de CAN-2002-1148 • http://issues.apache.org/bugzilla/show_bug.cgi?id=13365 •
CVSS: 7.5EPSS: 2%CPEs: 2EXPL: 1CVE-2002-1895
https://notcve.org/view.php?id=CVE-2002-1895
31 Dec 2002 — The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN. • http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0020.html •
CVSS: 7.5EPSS: 32%CPEs: 14EXPL: 3CVE-2002-2006 – Apache Tomcat 4.0/4.1 - Servlet Full Path Disclosure
https://notcve.org/view.php?id=CVE-2002-2006
31 Dec 2002 — The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets. • https://www.exploit-db.com/exploits/21412 •
CVSS: 5.3EPSS: 22%CPEs: 2EXPL: 8CVE-2002-2007 – Apache Tomcat 3.2.3/3.2.4 - 'RealPath.jsp' Information Disclosuree
https://notcve.org/view.php?id=CVE-2002-2007
31 Dec 2002 — The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages. • https://www.exploit-db.com/exploits/21492 •
CVSS: 5.3EPSS: 7%CPEs: 1EXPL: 0CVE-2002-2008
https://notcve.org/view.php?id=CVE-2002-2008
31 Dec 2002 — Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message. • http://archives.neohapsis.com/archives/bugtraq/2002-06/0225.html •
CVSS: 5.3EPSS: 2%CPEs: 1EXPL: 1CVE-2002-2009
https://notcve.org/view.php?id=CVE-2002-2009
31 Dec 2002 — Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message. • http://tomcat.apache.org/security-4.html •
CVSS: 7.8EPSS: 15%CPEs: 36EXPL: 2CVE-2002-2272 – Apache 1.3.x + Tomcat 4.0.x/4.1.x mod_jk - Chunked Encoding Denial of Service
https://notcve.org/view.php?id=CVE-2002-2272
31 Dec 2002 — Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values. • https://www.exploit-db.com/exploits/22068 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 39%CPEs: 19EXPL: 2CVE-2002-1148 – Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure
https://notcve.org/view.php?id=CVE-2002-1148
11 Oct 2002 — The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. El servlet por defecto (org.apache.catalina.servlets.DefaultServlet) en Tomcat 4.0.4 y 4.1.10 permite a atacantes remotos leer código fuente de ficheros del servidor mediante una petición directa al servlet. • https://www.exploit-db.com/exploits/21853 •
CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 0CVE-2002-0935
https://notcve.org/view.php?id=CVE-2002-0935
04 Oct 2002 — Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang. • http://archives.neohapsis.com/archives/vulnwatch/2002-q2/0120.html •
CVSS: 7.5EPSS: 8%CPEs: 1EXPL: 2CVE-2002-0936 – Apache Tomcat 3/4 - JSP Engine Denial of Service
https://notcve.org/view.php?id=CVE-2002-0936
31 Aug 2002 — The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null). • https://www.exploit-db.com/exploits/21534 •