CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 8CVE-2002-2007 – Apache Tomcat 3.2.3/3.2.4 - 'RealPath.jsp' Information Disclosuree
https://notcve.org/view.php?id=CVE-2002-2007
The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages. • https://www.exploit-db.com/exploits/21492 https://www.exploit-db.com/exploits/21490 https://www.exploit-db.com/exploits/21491 http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00272.html http://cert.uni-stuttgart.de/archive/bugtraq/2002/05/msg00275.html http://www.iss.net/security_center/static/9208.php http://www.kb.cert.org/vuls/id/116963 http://www.procheckup.com/security_info/vuln_pr0205.html http://www.procheckup.com/security_info/vuln_pr0206.html http: •
CVSS: 5.0EPSS: 1%CPEs: 19EXPL: 2CVE-2002-1148 – Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure
https://notcve.org/view.php?id=CVE-2002-1148
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. El servlet por defecto (org.apache.catalina.servlets.DefaultServlet) en Tomcat 4.0.4 y 4.1.10 permite a atacantes remotos leer código fuente de ficheros del servidor mediante una petición directa al servlet. • https://www.exploit-db.com/exploits/21853 http://marc.info/?l=bugtraq&m=103288242014253&w=2 http://online.securityfocus.com/advisories/4758 http://www.debian.org/security/2002/dsa-170 http://www.iss.net/security_center/static/10175.php http://www.redhat.com/support/errata/RHSA-2002-217.html http://www.redhat.com/support/errata/RHSA-2002-218.html http://www.securityfocus.com/bid/5786 https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev. •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2002-0493
https://notcve.org/view.php?id=CVE-2002-0493
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions. • http://marc.info/?l=bugtraq&m=101709002410365&w=2 http://www.apachelabs.org/tomcat-dev/200108.mbox/%3C20010810000819.6350.qmail%40icarus.apache.org%3E http://www.iss.net/security_center/static/9863.php https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cd • CWE-254: 7PK - Security Features •