CVSS: 7.5EPSS: 2%CPEs: 87EXPL: 0CVE-2009-0033 – tomcat6 Denial-Of-Service with AJP connection
https://notcve.org/view.php?id=CVE-2009-0033
05 Jun 2009 — Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. Apache Tomcat v4.1.0 hasta v4.1.39, v5.5.0 hasta v5.5.27 y v6.0.0 hasta v6.0.18, cuando se utilizan el c... • http://jvn.jp/en/jp/JVN87272440/index.html • CWE-20: Improper Input Validation •
CVSS: 4.6EPSS: 0%CPEs: 3EXPL: 0CVE-2009-0783 – tomcat XML parser information disclosure
https://notcve.org/view.php?id=CVE-2009-0783
05 Jun 2009 — Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. Apache Tomcat v4.1.0 hasta la v4.1.39, v5.5.0 hasta la v5.5.27 y v6.0.0 hasta la v6.0.18 permite a las aplicaciones web reemplazar un "parser" (... • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.5EPSS: 9%CPEs: 85EXPL: 0CVE-2009-0781 – tomcat: XSS in Apache Tomcat calendar application
https://notcve.org/view.php?id=CVE-2009-0781
09 Mar 2009 — Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." Una vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en jsp/cal/cal2.jsp en la aplicación 'calendar' de los ejemplos de aplicaciones Web de Apache Tomcat 4.1.0 a... • http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 96%CPEs: 3EXPL: 5CVE-2008-2938 – Apache Tomcat < 6.0.18 - 'utf8' Directory Traversal (PoC)
https://notcve.org/view.php?id=CVE-2008-2938
13 Aug 2008 — Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version. Una vulnerabilidad de salto de directorio (Directory Traversal) en Apache To... • https://packetstorm.news/files/id/180872 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.5EPSS: 14%CPEs: 82EXPL: 2CVE-2008-2370 – Apache Tomcat 6.0.16 - 'RequestDispatcher' Information Disclosure
https://notcve.org/view.php?id=CVE-2008-2370
04 Aug 2008 — Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter. Apache Tomcat 4.1.0 hasta la 4.1.37, 5.5.0 hasta la 5.5.26 y 6.0.0 hasta la 6.0.16, cuando se utiliza RequestDispatcher, realiza una regularización de ruta antes de eliminar la caden... • https://www.exploit-db.com/exploits/32137 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 30%CPEs: 3EXPL: 2CVE-2008-1232 – Apache Tomcat 6.0.16 - 'HttpServletResponse.sendError()' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-1232
04 Aug 2008 — Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Apache Tomcat 4.1.0 hasta la 4.1.37, 5.5.0 hasta la 5.5.26 y 6.0.0 hasta la 6.0.16, permite a atacantes remotos inyectar arbitrariamente ... • https://www.exploit-db.com/exploits/32138 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 4%CPEs: 35EXPL: 0CVE-2008-1947 – Tomcat host manager xss - name field
https://notcve.org/view.php?id=CVE-2008-1947
04 Jun 2008 — Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add. Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en Apache Tomcat v5.5.9 a la v5.5.26 y v6.0.0 a la v6.0.16, permite a atacantes remotos inyectar secuencias de comandos web y HTML de su elección a través del parámetro name (también conoc... • http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 68%CPEs: 3EXPL: 2CVE-2007-5333 – Apache Tomcat 6.0.15 - Cookie Quote Handling Remote Information Disclosure
https://notcve.org/view.php?id=CVE-2007-5333
12 Feb 2008 — Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385. Apache Tomcat 6.0.0 hasta 6.0.14, 5.5.0 hasta 5.5.25, 4.1.36 y 4.1.0 al no manejar adecuadamente secuencias (... • https://www.exploit-db.com/exploits/31130 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 4%CPEs: 31EXPL: 0CVE-2007-6286 – HP Security Bulletin HPSBST02955
https://notcve.org/view.php?id=CVE-2007-6286
12 Feb 2008 — Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request. Apache Tomcat de 5.5.11 a 5.5.25 y de 6.0.0 a 6.0.15, cuando se utiliza el conector ARP nativo no maneja correctamente una petición vacía al puerto SSL, lo que permite a atacantes remotos di... • http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html •
CVSS: 7.5EPSS: 0%CPEs: 11EXPL: 0CVE-2008-0002 – Tomcat information disclosure vulnerability
https://notcve.org/view.php?id=CVE-2008-0002
12 Feb 2008 — Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception. Apache Tomcat 6.0.0 hasta 6.0.15 procesa parámetros en el contexto de una solicitud errónea cuando ocurre una excepción durante el procesamiento del parámetro, lo cual permite a atacantes remotos obtener inf... • http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html •