CVSS: 6.1EPSS: 1%CPEs: 37EXPL: 0CVE-2006-7195 – tomcat XSS in example webapps
https://notcve.org/view.php?id=CVE-2006-7195
09 May 2007 — Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en implicit-objects.jsp del Apache Tomcat 5.0.0 hasta el 5.0.30 y el 5.5.0 hasta la 5.5.17 permite a atacantes remotos la inyección de secuencias de comandos web o HTML de su elección a través de ciertos valores en la cabecera. • http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 43EXPL: 1CVE-2007-1858 – tomcat anonymous cipher issue
https://notcve.org/view.php?id=CVE-2007-1858
09 May 2007 — The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts. La configuración de cifrado SSL por defecto en Apache Tomcat 4.1.28 hasta 4.1.31, 5.0.0 hasta 5.0.30, y 5.5.0 hasta 5.5.17 utiliza determinadas claves inseguras, incluyendo la clave anónima, lo cual permite a atacantes remotos ... • https://github.com/anthophilee/A2SV--SSL-VUL-Scan •
CVSS: 7.5EPSS: 97%CPEs: 3EXPL: 1CVE-2007-0450 – Apache Tomcat 5.x/6.0.x - Directory Traversal
https://notcve.org/view.php?id=CVE-2007-0450
16 Mar 2007 — Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache. Vulnerabilidad de salto de directorio en Apache HTTP Server y Tomcat 5.x anterior a 5.5... • https://www.exploit-db.com/exploits/29739 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 39%CPEs: 5EXPL: 3CVE-2006-3835 – Apache Tomcat 5 - Information Disclosure
https://notcve.org/view.php?id=CVE-2006-3835
25 Jul 2006 — Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do. Apache Tomcat 5 anterior a 5.5.17 permite a atacantes remotos listar directorios a través de un punto y coma (;) precedido de un nombre de archivo con una extensión mapeada, como se demostró con las URLs finalizadas con /;index.jsp y /;help.do. • https://www.exploit-db.com/exploits/28254 •
CVSS: 7.5EPSS: 2%CPEs: 12EXPL: 0CVE-2005-3510 – tomcat DoS
https://notcve.org/view.php?id=CVE-2005-3510
06 Nov 2005 — Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files. • http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx •