Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:138)

Multiple security vulnerabilities has been identified and fixed in tomcat5 : Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, whic...

Mandriva Linux Security Advisory : tomcat5 (MDVSA-2009:136)

Multiple security vulnerabilities has been identified and fixed in tomcat5 : When Tomcat's WebDAV servlet is configured for use with a context and has been enabled for write, some WebDAV requests that specify an entity with a SYSTEM tag can result in the contents of arbitary files being returned ...

Apache Tomcat Cross-Application File Manipulation

According to its self-reported version number, the remote host is running a vulnerable version of Apache Tomcat. Affected versions permit a web application to replace the XML parser used to process the XML and TLD files of other applications. This could allow a malicious web app to read or modify...

Apache Tomcat denial of service (DoS) vulnerability

Overview Apache Tomcat from The Apache Software Foundation contains a denial of service DoS vulnerability. Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page JSP technologies. If Tomcat receives a request with an invalid header via the...

Apache Tomcat Detection

Nessus was able to detect a remote Apache Tomcat web server. NOTE: When paranoia levels are elevated, this plugin will also consider versions obtained from responses with non-200 HTTP status codes. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid39446;...

Apache Tomcat RequestDispatcher Directory Traversal Arbitrary File Access

According to its self-reported version number, the remote host is running a vulnerable version of Apache Tomcat. Due to a bug in a RequestDispatcher API, target paths are normalized before the query string is removed, which could result in directory traversal attacks. This allows a remote attacke...

Directory traversal

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

CVE-2008-5515

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

CVE-2008-5515

The CVE-2008-5515 entry applies to Apache Tomcat 4.1.0–4.1.39, 5.5.0–5.5.27, and 6.0.0–6.0.18 (and possibly earlier) per the described vulnerability. Root cause: during RequestDispatcher usage, Tomcat normalizes the target pathname before filtering the query string, which can bypass access contro...

CVE-2008-5515

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

Apache Tomcat Multiple Vulnerabilities (Jun 2009)

Apache Tomcat Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...

RedHat Security Advisory RHSA-2009:1087

The remote host is missing updates announced in advisory RHSA-2009:1087. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to communicate with each other. An information disclosure flaw was found in modjk. In certain situations, if a faulty client set the...

RedHat Security Advisory RHSA-2009:1087

The remote host is missing updates announced in advisory RHSA-2009:1087. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to communicate with each other. An information disclosure flaw was found in modjk. In certain situations, if a faulty client set the...

[SECURITY] UPDATED CVE-2008-5515 RequestDispatcher directory traversal vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Updated to add additional patches required for 5.5.x and 4.1.x CVE-2008-5515: Apache Tomcat information disclosure vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.1.0 to 4.1.39 Tomcat 5.5.0 to 5.5.2...

Apache Tomcat multiple security vulnerabilities

Information leak, user enumeration, DoS, directory traversal...

mod_jk: session information leak

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...

Important: Red Hat Security Advisory: mod_jk security update

Updated modjk packages that fix one security issue are now available for Red Hat Application Server v2. This update has been rated as having important security impact by the Red Hat Security Response Team. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to...

Apache Tomcat XML解析器非授权文件读写漏洞

CVECAN ID: CVE-2009-0783 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat允许Web应用替换其他Web应用所使用的XML解析器。如果特制的应用早于目标应用加载的话，本地用户就可以读取或修改任意Web应用的web.xml、context.xml或tld文件。 Apache Group Tomcat 6.0.x Apache Group Tomcat 5.5.x Apache Group Tomcat 4.1.x 厂商补丁： Apache Group ------------...

Apache Tomcat Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2008-5515: Apache Tomcat information disclosure vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.1.0 to 4.1.39 Tomcat 5.5.0 to 5.5.27 Tomcat 6.0.0 to 6.0.18 The unsupported Tomcat 3.x, 4.0.x and...

JVN#63832775: Apache Tomcat information disclosure vulnerability

Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat contains a vulnerability which may allow information disclosure or access to the contents contained in the WEB-INF directory. Impact A remote attacker cou...