CVSS: 5.8EPSS: 16%CPEs: 12EXPL: 0CVE-2011-1419 – Gentoo Linux Security Advisory 201206-24
https://notcve.org/view.php?id=CVE-2011-1419
14 Mar 2011 — Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088. Apache Tomcat v7.x anterior a v7.0.11, cuando web.xml no tiene restricciones de seguridad, no sigue anotaciones ServletSecurity, lo que permite a atacantes remotos evitar las restricciones de acceso a tr... • http://mail-archives.apache.org/mod_mbox/www-announce/201103.mbox/%3C4D6E74FF.7050106%40apache.org%3E •
CVSS: 4.3EPSS: 32%CPEs: 65EXPL: 2CVE-2011-0013 – tomcat: XSS vulnerability in HTML Manager interface
https://notcve.org/view.php?id=CVE-2011-0013
05 Feb 2011 — Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados (XSS) en la interfaz de HTML Manager en Apache Software Foundation Tomcat v7.0 antes de v7.0.6, v5.5 antes de v5.5.32 y v6.0 antes de v6.0.30 permiten a atacantes remotos inyecta... • https://packetstorm.news/files/id/98176 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.3EPSS: 17%CPEs: 34EXPL: 0CVE-2011-0534 – tomcat: remote DoS via NIO connector
https://notcve.org/view.php?id=CVE-2011-0534
05 Feb 2011 — Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request. Apache Tomcat v7.0.0 hasta v7.0.6 y v6.0.0 hasta v6.0.30 no hace cumplir el límite maxHttpHeaderSize de las solicitudes relacionadas con el conector NIO HTTP, que permite a atacantes remotos provocar una denegación de servicio (OutOfMemoryError) a través de un... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html • CWE-399: Resource Management Errors •
CVSS: 4.0EPSS: 0%CPEs: 63EXPL: 0CVE-2010-3718 – tomcat: file permission bypass flaw
https://notcve.org/view.php?id=CVE-2010-3718
05 Feb 2011 — Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack. Apache Tomcat v7.0.0 hasta v7.0.3, v6.0.x, y v5.5.x, cuando se ejecuta dentro de un SecurityManager no tiene el atributo ServletContext de sólo lectura, lo que permite a las aplicaciones web locales leer y escrib... • http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html •
CVSS: 4.3EPSS: 22%CPEs: 20EXPL: 2CVE-2010-4172 – Apache Tomcat 7.0.4 - 'sort' / 'orderBy' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2010-4172
23 Nov 2010 — Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados en la aplica... • https://www.exploit-db.com/exploits/35011 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •