Apache Tomcat Default Accounts

This host appears to be the running the Apache Tomcat Servlet engine with the default accounts still configured. A potential intruder could reconfigure this service in a way that grants system access. %NASLMINLEVEL 70300 This script was written by Orlando Padilla See the Nessus Scripts License fo...

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

[SECURITY] [DSA 225-1] New tomcat packages fix source disclosure vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 225-1 [email protected] http://www.debian.org/security/ Martin Schulze January 9th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 225-1] New tomcat packages fix source disclosure vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 225-1 [email protected] http://www.debian.org/security/ Martin Schulze January 9th, 2002 http://www.debian.org/security/faq -...

DSA-225 tomcat4 - source disclosure

Bulletin has no description...

CVE-2002-2009

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 /, and 4 %20/, which leaks the pathname in an error message...

CVE-2002-2008

Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message...

CVE-2002-1895

The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service crash via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN...

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the 1 SnoopServlet or 2 TroubleShooter example servlets...

CVE-2002-2007

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages JSP in the 1 test/jsp, 2 samples/jsp and 3 examples/jsp directories, or the 4...

Apache Tomcat MS-DOS Device Name Request DoS

It was possible to freeze or crash Windows or the Apache Tomcat web server by reading thousands of times an MS/DOS device through the Tomcat servlet engine, using a file name like /examples/servlet/AUX. An attacker can exploit this flaw to make your system crash continuously, preventing you from...

tomcat.dos.sh

-----BEGIN PGP SIGNED MESSAGE----- Apache Tomcat: Remote denial-of-service vulnerability 2002-09-06 2002-10-11 Vendor contacted on 2002-09-06. Vendor is verifying the problem since 2002-09-10. No news since then... Microsoft Windows 2000 Microsoft Windows NT may be affected as well. Apache Tomcat...

CVE-2002-0935

Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service resource exhaustion via a large number of requests to the server with null characters, which causes the working threads to hang...

Apache Tomcat 3.2 - Directory Disclosure

Apache Tomcat 3.2 - Directory Disclosure source: https://www.securityfocus.com/bid/5838/info Apache Tomcat is reported to be prone to a vulnerability which may enable remote attackers to disclose the contents of directories. This issue is reported to affect Apache Tomcat 3.2.x on HP-UX 11.04 VVOS...

Apache Tomcat 3.2 - Directory Disclosure

source: https://www.securityfocus.com/bid/5838/info Apache Tomcat is reported to be prone to a vulnerability which may enable remote attackers to disclose the contents of directories. This issue is reported to affect Apache Tomcat 3.2.x on HP-UX 11.04 VVOS systems. It is not known whether other...

Unauthorizaed Apache Tomcat JSP source code disclosure

org.apache.catalina.servlets.DefaultServ let allows to access any JSP code...

Apache Tomcat 34 - DefaultServlet File Disclosure

Apache Tomcat 34 - DefaultServlet File Disclosure source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes...

Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure

source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data...

Fixed in Apache Tomcat 4.1.12, 4.0.5

Important: Information disclosure CVE-2002-1148 A specially crafted URL using the default servlet can enable an attacker to obtain the source of JSP pages. Affects: 4.0.0-4.0.4, 4.1.0-4.1.11...

Crossite scripting in Apache Tomcat

It's posible to insert script in request to different servlett classes...