Apache Tomcat default installation contains sample applications that disclose webroot path

Overview There is an insecure default configuration in Apache Tomcat web server that places several sample applications in the webroot. Remote users may be able to use these applications to gain sensitive information about the server's configuration. Description There are several sample...

Vulnerability in Apache Tomcat v3.23 & v3.24

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-05 Description: Tomcat source.jsp directory listing and webroot location display Date: 8/1/2002 Application: Apache Tomcat Java server versions 3.23 and 3.24 Platform: Linux/Unix Severity: Remote attackers can obtain listings of...

Vulnerability in Apache Tomcat v3.23 & v3.24 (part 2)

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-06 Description: Tomcat realPath.jsp gives location of web root. Date: 8/1/2002 Application: Apache Tomcat Java server versions 3.23 and 3.24 Platform: Linux/Unix Severity: Remote attackers can obtain the location of webroot...

Vulnerability in Apache Tomcat v3.23 & v3.24 (part 3)

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-7 Description: Tomcat multiple sample files display webroot location on default configuration on request. Date: 8/1/2002 Application: Apache Tomcat java server v3.23, 3.24. Platform: Linux/Unix Severity: Remote attackers can obta...

Apache Tomcat 3.2.33.2.4 - Source.jsp Information Disclosure

Apache Tomcat 3.2.33.2.4 - Source.jsp Information Disclosure source: https://www.securityfocus.com/bid/4876/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server...

Apache Tomcat 3.2.33.2.4 - Example Files Web Root Full Path Disclosure

Apache Tomcat 3.2.33.2.4 - Example Files Web Root Full Path Disclosure source: https://www.securityfocus.com/bid/4877/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. When Apache Tomcat is installed with a default configuration, several example...

Apache Tomcat 3.2.33.2.4 - RealPath.jsp Information Disclosuree

Apache Tomcat 3.2.33.2.4 - RealPath.jsp Information Disclosuree source: https://www.securityfocus.com/bid/4878/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web serve...

Apache Tomcat 3.2.3/3.2.4 - Example Files Web Root Full Path Disclosure

source: https://www.securityfocus.com/bid/4877/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. When Apache Tomcat is installed with a default configuration, several example files are also installed. When some of these example files are request...

Apache Tomcat 3.2.3/3.2.4 - 'Source.jsp' Information Disclosure

source: https://www.securityfocus.com/bid/4876/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the source.jsp page is passed a malformed...

Apache Tomcat 3.2.3/3.2.4 - 'RealPath.jsp' Information Disclosuree

source: https://www.securityfocus.com/bid/4878/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the realPath.jsp page is accessed, it may...

Apache Tomcat 4.04.1 - Servlet Full Path Disclosure

Apache Tomcat 4.04.1 - Servlet Full Path Disclosure source: https://www.securityfocus.com/bid/4575/info Apache Tomcat is a servlet container for use with the Java Servlet and JavaServer Pages technologies. Tomcat may be run on most UNIX and Linux variants as well as Microsoft Windows. Apache Tomc...

Apache Tomcat 4.0/4.1 - Servlet Full Path Disclosure

source: https://www.securityfocus.com/bid/4575/info Apache Tomcat is a servlet container for use with the Java Servlet and JavaServer Pages technologies. Tomcat may be run on most UNIX and Linux variants as well as Microsoft Windows. Apache Tomcat ships with a number of example classes SnoopServl...

Fixed in Apache Tomcat 4.0.0

Moderate: Security manager bypass CVE-2002-0493 If errors are encountered during the parsing of web.xml and Tomcat is configured to use a security manager it is possible for Tomcat to start without the security manager in place. Affects: Pre-release builds of 4.0.0...

CVE-2000-1210

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. dot dot in the argument to source.jsp...

CVE-2001-0590

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification i.e. HTTP/1.0...

Fixed in Apache Tomcat 3.2.4

Moderate: Information disclosure CVE-2001-1563 No specifics are provided in the vulnerability report. This may be a summary of other issues reported against 3.2.x Affects: 3.2?, 3.2.1, 3.2.2-3.2.3?...

CVE-2001-0829

A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message...

Apache Tomcat Nonexistent File Error Message Path Disclosure

Tomcat will reveal the physical path of the webroot when asked for a nonexistent .jsp file. An unauthenticated, remote attacker can exploit this via a specially crafted request. An attacker can use this flaw to gain further knowledge about the remote filesystem layout. %NASLMINLEVEL 70300 C Tenab...

CVE-2001-0829

A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message...

CVE-2001-0829

Apache Tomcat 3.x is affected by a cross-site scripting vulnerability (CVE-2001-0829) in which a malicious user can craft a request for a JSP file so that the default error page echoes the user-supplied input without proper escaping. The root cause is the error page displaying unvalidated URLs, a...