CVSS: 5.0EPSS: 13%CPEs: 9EXPL: 1CVE-2003-0042 – Apache Tomcat 3.x - Null Byte Directory / File Disclosure
https://notcve.org/view.php?id=CVE-2003-0042
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character. Jakarta Tomcat antes de 3.3.1a, cuando se usa con JDK 1.3.1 o anterior, permite a atacantes remotos listar directorios incluso cuando un index.html u otro fichero presente mediante una URL conteniendo un carácter nulo. • https://www.exploit-db.com/exploits/22205 http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt http://marc.info/?l=bugtraq&m=104394568616290&w=2 http://secunia.com/advisories/7972 http://secunia.com/advisories/7977 http://www.ciac.org/ciac/bulletins/n-060.shtml http://www.debian.org/security/2003/dsa-246 http://www.securityfocus.com/advisories/5111 http://ww •
CVSS: 6.8EPSS: 92%CPEs: 10EXPL: 0CVE-2003-0044
https://notcve.org/view.php?id=CVE-2003-0044
Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML. Vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en las apliaciones ejemplos y ROOT web en Jakarta Tomcat 3.x a 3.3.1a permite a atacantes remotos ejecutar scripts web arbitrarios • http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a http://jakarta.apache.org/builds/jakarta-tomcat/release/v3.3.1a/RELEASE-NOTES-3.3.1a.txt http://secunia.com/advisories/7972 http://www.ciac.org/ciac/bulletins/n-060.shtml http://www.debian.org/security/2003/dsa-246 http://www.osvdb.org/9203 http://www.osvdb.org/9204 http://www.securityfocus.com/advisories/5111 http://www.securityfocus.com/bid/6720 https://exchange.xforce.ibmcloud.com/vulnerabilities&# •
CVSS: 5.0EPSS: 1%CPEs: 14EXPL: 3CVE-2002-2006 – Apache Tomcat 4.0/4.1 - Servlet Full Path Disclosure
https://notcve.org/view.php?id=CVE-2002-2006
The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets. • https://www.exploit-db.com/exploits/21412 http://archives.neohapsis.com/archives/bugtraq/2002-04/0311.html http://secunia.com/advisories/30899 http://secunia.com/advisories/30908 http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1 http://tomcat.apache.org/security-4.html http://www.iss.net/security_center/static/8932.php http://www.securityfocus.com/bid/4575 http://www.vupen.com/english/advisories/2008/1979/references https://lists.apache.org/thread.html •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 1CVE-2002-1895
https://notcve.org/view.php?id=CVE-2002-1895
The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN. • http://archives.neohapsis.com/archives/vulnwatch/2002-q4/0020.html http://tomcat.apache.org/security-4.html http://www.iss.net/security_center/static/10348.php https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E •
CVSS: 5.0EPSS: 1%CPEs: 19EXPL: 2CVE-2002-1148 – Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure
https://notcve.org/view.php?id=CVE-2002-1148
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. El servlet por defecto (org.apache.catalina.servlets.DefaultServlet) en Tomcat 4.0.4 y 4.1.10 permite a atacantes remotos leer código fuente de ficheros del servidor mediante una petición directa al servlet. • https://www.exploit-db.com/exploits/21853 http://marc.info/?l=bugtraq&m=103288242014253&w=2 http://online.securityfocus.com/advisories/4758 http://www.debian.org/security/2002/dsa-170 http://www.iss.net/security_center/static/10175.php http://www.redhat.com/support/errata/RHSA-2002-217.html http://www.redhat.com/support/errata/RHSA-2002-218.html http://www.securityfocus.com/bid/5786 https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev. •