CVE-2002-0935

The CVE-2002-0935 issue affects Apache Tomcat 4.0.3 and possibly earlier 4.1.3 beta; it enables remote denial of service through a flood of requests containing null characters, causing server threads to hang due to resource exhaustion. The vulnerability targets the HTTP request handling path, lea...

CVE-2002-0935: Undefined Security Weakness

Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service resource exhaustion via a large number of requests to the server with null characters, which causes the working threads to hang...

CVE-2002-0493: Undefined Security Weakness

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions...

CVE-2000-1210: Undefined Security Weakness

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. dot dot in the argument to source.jsp...

Apache Tomcat Directory Listing and File Disclosure

Apache Tomcat prior to 3.3.1a is affected by a directory listing and file disclosure vulnerability. By requesting URLs containing a null character, remote attackers can list directories even when an index.html or other file is present or obtain unprocessed source code for a JSP file. Also note...

Tomcat /status Information Disclosure

Requesting the URI '/status' gives information about the currently running instance of the remote web server most likely Apache Tomcat. It also allows anybody to reset the current statistics. A remote attacker can use this information to mount further attacks. This script was written by Vincent...

Multiple bugs in Apache Tomcat

It's possible to obtain physical path and directory listing...

Apache Tomcat multiple bugs

Multiple vulnerability allow directory browsing and source code disclosure...

Apache Tomcat 3.x - Null Byte Directory / File Disclosure

source: https://www.securityfocus.com/bid/6721/info Apache Tomcat is prone to a directory/file disclosure vulnerability when used with JDK 1.3.1 or earlier. It has been reported that remote attackers may view directory contents even when an 'index.html' or other welcome file. It is also possible...

Apache Tomcat 3.x - Null Byte Directory File Disclosure

Apache Tomcat 3.x - Null Byte Directory File Disclosure source: https://www.securityfocus.com/bid/6721/info Apache Tomcat is prone to a directory/file disclosure vulnerability when used with JDK 1.3.1 or earlier. It has been reported that remote attackers may view directory contents even when an...

Fixed in Apache Tomcat 3.3.1

Important: Denial of service CVE-2003-0045 JSP page names that match a Windows DOS device name, such as aux.jsp, may cause the thread processing the request to become unresponsive. A sequence of such requests may cause all request processing threads, and hence Tomcat, to become unresponsive...

Fixed in Apache Tomcat 3.3.2

Moderate: Cross site scripting CVE-2003-0044 The root web application and the examples web application contained a number a cross-site scripting vulnerabilities. Note that is it recommended that the examples web application is not installed on production servers. Affects: 3.0, 3.1-3.1.1, 3.2-3.2....

Fixed in Apache Tomcat 3.3.1a

Important: Information disclosure CVE-2003-0043 When used with JDK 1.3.1 or earlier, web.xml files were read with trusted privileges enabling files outside of the web application to be read even when running under a security manager. Affects: 3.0, 3.1-3.1.1, 3.2-3.2.4, 3.3a-3.3.1 Important:...

Apache Tomcat Default Accounts

This host appears to be the running the Apache Tomcat Servlet engine with the default accounts still configured. A potential intruder could reconfigure this service in a way that grants system access. %NASLMINLEVEL 70300 This script was written by Orlando Padilla See the Nessus Scripts License fo...

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

[SECURITY] [DSA 225-1] New tomcat packages fix source disclosure vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 225-1 [email protected] http://www.debian.org/security/ Martin Schulze January 9th, 2002 http://www.debian.org/security/faq -...

[SECURITY] [DSA 225-1] New tomcat packages fix source disclosure vulnerability

-------------------------------------------------------------------------- Debian Security Advisory DSA 225-1 [email protected] http://www.debian.org/security/ Martin Schulze January 9th, 2002 http://www.debian.org/security/faq -...

DSA-225 tomcat4 - source disclosure

Bulletin has no description...

CVE-2002-2007

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages JSP in the 1 test/jsp, 2 samples/jsp and 3 examples/jsp directories, or the 4...

CVE-2002-1895

The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service crash via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN...