Apache

Tomcat

231 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5

CVE-2003-0045

  • EPSS 1.51%
  • Published 07.02.2003 05:00:00
  • Last modified 03.04.2025 01:03:51

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

7.5

CVE-2002-1394

  • EPSS 5.35%
  • Published 17.01.2003 05:00:00
  • Last modified 03.04.2025 01:03:51

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

5

CVE-2002-1895

Exploit
  • EPSS 2.79%
  • Published 31.12.2002 05:00:00
  • Last modified 03.04.2025 01:03:51

The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or P...

5

CVE-2002-2006

Exploit
  • EPSS 32.36%
  • Published 31.12.2002 05:00:00
  • Last modified 03.04.2025 01:03:51

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

5

CVE-2002-2007

Exploit
  • EPSS 22.61%
  • Published 31.12.2002 05:00:00
  • Last modified 03.04.2025 01:03:51

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) s...

5

CVE-2002-2008

  • EPSS 7.15%
  • Published 31.12.2002 05:00:00
  • Last modified 03.04.2025 01:03:51

Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.

5

CVE-2002-2009

Exploit
  • EPSS 3.22%
  • Published 31.12.2002 05:00:00
  • Last modified 03.04.2025 01:03:51

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.

7.8

CVE-2002-2272

Exploit
  • EPSS 23.16%
  • Published 31.12.2002 05:00:00
  • Last modified 03.04.2025 01:03:51

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values...

5

CVE-2002-1148

Exploit
  • EPSS 36.69%
  • Published 11.10.2002 04:00:00
  • Last modified 03.04.2025 01:03:51

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

5

CVE-2002-0935

  • EPSS 2.83%
  • Published 04.10.2002 04:00:00
  • Last modified 03.04.2025 01:03:51

Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang...