Apache

Tomcat

231 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.4

CVE-2007-5342

  • EPSS 12.42%
  • Published 27.12.2007 22:46:00
  • Last modified 09.04.2025 00:30:58

The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and ov...

3.5

CVE-2007-5461

Exploit
  • EPSS 7.17%
  • Published 15.10.2007 18:17:00
  • Last modified 09.04.2025 00:30:58

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write reque...

4.3

CVE-2007-4724

  • EPSS 0.68%
  • Published 05.09.2007 19:17:00
  • Last modified 09.04.2025 00:30:58

Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.

4.3

CVE-2007-3382

  • EPSS 84.87%
  • Published 14.08.2007 22:17:00
  • Last modified 09.04.2025 00:30:58

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attacker...

4.3

CVE-2007-3385

  • EPSS 65.35%
  • Published 14.08.2007 22:17:00
  • Last modified 09.04.2025 00:30:58

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remot...

4.3

CVE-2007-3386

  • EPSS 46.13%
  • Published 14.08.2007 22:17:00
  • Last modified 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases paramet...

4.3

CVE-2007-3384

  • EPSS 2.82%
  • Published 08.08.2007 01:17:00
  • Last modified 09.04.2025 00:30:58

Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.

4.3

CVE-2007-3383

  • EPSS 36.59%
  • Published 25.07.2007 17:30:00
  • Last modified 09.04.2025 00:30:58

Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML ...

4.3

CVE-2007-2449

  • EPSS 80.3%
  • Published 14.06.2007 23:30:00
  • Last modified 09.04.2025 00:30:58

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote att...

3.5

CVE-2007-2450

  • EPSS 1.24%
  • Published 14.06.2007 23:30:00
  • Last modified 09.04.2025 00:30:58

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote...