CVSS: 6.5EPSS: 0%CPEs: 27EXPL: 0CVE-2010-4312
https://notcve.org/view.php?id=CVE-2010-4312
26 Nov 2010 — The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie. La configuración por defecto de Apache Tomcat v6.x no incluye la bandera HTTPOnly en un encabezado Set-Cookie, lo cual hace más fácil para los atacantes remotos secuestrar una sesión a traves del acceso mediante secuencias de comandos a una cookie. • http://www.securityfocus.com/archive/1/514866/100/0/threaded • CWE-16: Configuration •
CVSS: 6.5EPSS: 68%CPEs: 55EXPL: 1CVE-2010-2227 – tomcat: information leak vulnerability in the handling of 'Transfer-Encoding' header
https://notcve.org/view.php?id=CVE-2010-2227
13 Jul 2010 — Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interferes with "recycling of a buffer." Apache Tomcat v5.5.0 hasta v5.5.29, v6.0.0 hasta v6.0.27 y v7.0.0 beta, no maneja apropiadamente una cabecera Transer-Encoding inválida, lo que permite a atacantes remotos causar una denegación de s... • https://packetstorm.news/files/id/180512 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.7EPSS: 11%CPEs: 53EXPL: 1CVE-2010-1157 – Apache Tomcat 5.5.0 < 5.5.29 / 6.0.0 < 6.0.26 - Information Disclosure
https://notcve.org/view.php?id=CVE-2010-1157
23 Apr 2010 — Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply. Apache Tomcat en sus versiones v5.5.0 a v5.5.29 y v6.0.0 a v6.0.26 podría permitir a atacantes remotos descubrir el nombre del servidor o su dirección IP mediante el envío de una solicitud de un recurso que ... • https://www.exploit-db.com/exploits/12343 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 51EXPL: 0CVE-2009-2693 – tomcat: unexpected file deletion and/or alteration
https://notcve.org/view.php?id=CVE-2009-2693
28 Jan 2010 — Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry. Vulnerabilidad de salto de directorio en Apache Tomcat v5.5.0 a la v5.5.28 y v6.0.0 a la v6.0.20, permite a atacantes remotos crear, sobrescribir archivos de su elección a través de .. (punto punto) en una entrada en un archivo WAR, como se demostró con l... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 51EXPL: 0CVE-2009-2902 – tomcat: unexpected file deletion in work directory
https://notcve.org/view.php?id=CVE-2009-2902
28 Jan 2010 — Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename. Vulnerabilidad de salto de directorio en Apache Tomcat desde v5.5.0 hasta v5.5.28 y desde v6.0.0 hasta v6.0.20 permite a atacantes remotos borrar ficheros del directorio de trabajo a través de secuencias de salto de directorio en un nombre de fichero WAR, como se dem... • http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 0%CPEs: 51EXPL: 0CVE-2009-2901 – HP Security Bulletin HPSBST02955
https://notcve.org/view.php?id=CVE-2009-2901
28 Jan 2010 — The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. El proceso de auto despliegue en Apache Tomcat desde v5.5.0 hasta v5.5.28 y desde v6.0.0 hasta v6.0.20, cuando AutoDeploy esta activado, despliega ficheros appBase que se mantienen de un plegado fallido lo que permite a atacantes remo... • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 9.8EPSS: 24%CPEs: 142EXPL: 3CVE-2009-3548 – Apache Tomcat Manager - Application Upload (Authenticated) Code Execution
https://notcve.org/view.php?id=CVE-2009-3548
12 Nov 2009 — The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges. El instalador de Windows para Apache Tomcat 6.0.0 a 6.0.20, 5.5.0 a 5.5.28, y posiblemente versiones anteriores, usa una contraseña en blanco por defecto para el usuario administrador, lo que permite a atacantes remotos obtener privilegios. Potential security vulnerabilities have been ide... • https://packetstorm.news/files/id/125021 • CWE-255: Credentials Management Errors •
CVSS: 7.5EPSS: 0%CPEs: 80EXPL: 0CVE-2008-5515 – tomcat request dispatcher information disclosure vulnerability
https://notcve.org/view.php?id=CVE-2008-5515
16 Jun 2009 — Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. Apache Tomcat desde v4.1.0 hasta v4.1.39, desde v5.5.0 hasta v5.5.27, desde v6.0.0 hasta v6.0.18, y posiblemente version... • http://jvn.jp/en/jp/JVN63832775/index.html • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 96%CPEs: 87EXPL: 2CVE-2009-0580 – Apache Tomcat 6.0.18 - Form Authentication Existing/Non-Existing 'Username' Enumeration
https://notcve.org/view.php?id=CVE-2009-0580
05 Jun 2009 — Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter. Apache Tomcat v4.1.0 hasta v4.1.39, v5.5.0 hasta v5.5.27, y v6.0.0 hasta v6... • https://packetstorm.news/files/id/181053 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 2%CPEs: 87EXPL: 0CVE-2009-0033 – tomcat6 Denial-Of-Service with AJP connection
https://notcve.org/view.php?id=CVE-2009-0033
05 Jun 2009 — Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. Apache Tomcat v4.1.0 hasta v4.1.39, v5.5.0 hasta v5.5.27 y v6.0.0 hasta v6.0.18, cuando se utilizan el c... • http://jvn.jp/en/jp/JVN87272440/index.html • CWE-20: Improper Input Validation •