Apache Tomcat Cross-Application File Manipulation

According to its self-reported version number, the remote host is running a vulnerable version of Apache Tomcat. Affected versions permit a web application to replace the XML parser used to process the XML and TLD files of other applications. This could allow a malicious web app to read or modify...

Apache Tomcat denial of service (DoS) vulnerability

Overview Apache Tomcat from The Apache Software Foundation contains a denial of service DoS vulnerability. Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page JSP technologies. If Tomcat receives a request with an invalid header via the...

Apache Tomcat Detection

Nessus was able to detect a remote Apache Tomcat web server. NOTE: When paranoia levels are elevated, this plugin will also consider versions obtained from responses with non-200 HTTP status codes. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid39446;...

Apache Tomcat RequestDispatcher Directory Traversal Arbitrary File Access

According to its self-reported version number, the remote host is running a vulnerable version of Apache Tomcat. Due to a bug in a RequestDispatcher API, target paths are normalized before the query string is removed, which could result in directory traversal attacks. This allows a remote attacke...

Directory traversal

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

CVE-2008-5515

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

CVE-2008-5515

The CVE-2008-5515 entry applies to Apache Tomcat 4.1.0–4.1.39, 5.5.0–5.5.27, and 6.0.0–6.0.18 (and possibly earlier) per the described vulnerability. Root cause: during RequestDispatcher usage, Tomcat normalizes the target pathname before filtering the query string, which can bypass access contro...

CVE-2008-5515

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

Apache Tomcat Multiple Vulnerabilities (Jun 2009)

Apache Tomcat Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat";...

CVE-2008-5515: Improper Limitation of a Pathname to a Restricted Directory

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct...

RedHat Security Advisory RHSA-2009:1087

The remote host is missing updates announced in advisory RHSA-2009:1087. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to communicate with each other. An information disclosure flaw was found in modjk. In certain situations, if a faulty client set the...

RedHat Security Advisory RHSA-2009:1087

The remote host is missing updates announced in advisory RHSA-2009:1087. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to communicate with each other. An information disclosure flaw was found in modjk. In certain situations, if a faulty client set the...

Apache Tomcat multiple security vulnerabilities

Information leak, user enumeration, DoS, directory traversal...

[SECURITY] UPDATED CVE-2008-5515 RequestDispatcher directory traversal vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Updated to add additional patches required for 5.5.x and 4.1.x CVE-2008-5515: Apache Tomcat information disclosure vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.1.0 to 4.1.39 Tomcat 5.5.0 to 5.5.2...

Important: Red Hat Security Advisory: mod_jk security update

Updated modjk packages that fix one security issue are now available for Red Hat Application Server v2. This update has been rated as having important security impact by the Red Hat Security Response Team. modjk is an Apache Tomcat connector that allows Apache Tomcat and the Apache HTTP Server to...

mod_jk: session information leak

The JK Connector aka modjk 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving 1 a request from a different client that included a Content-Length header but no POST dat...

Apache Tomcat XML解析器非授权文件读写漏洞

CVECAN ID: CVE-2009-0783 Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat允许Web应用替换其他Web应用所使用的XML解析器。如果特制的应用早于目标应用加载的话，本地用户就可以读取或修改任意Web应用的web.xml、context.xml或tld文件。 Apache Group Tomcat 6.0.x Apache Group Tomcat 5.5.x Apache Group Tomcat 4.1.x 厂商补丁： Apache Group ------------...

Apache Tomcat Information Disclosure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2008-5515: Apache Tomcat information disclosure vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.1.0 to 4.1.39 Tomcat 5.5.0 to 5.5.27 Tomcat 6.0.0 to 6.0.18 The unsupported Tomcat 3.x, 4.0.x and...

[SECURITY] CVE-2008-5515 RequestDispatcher directory traversal vulnerability

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2008-5515: Apache Tomcat information disclosure vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: Tomcat 4.1.0 to 4.1.39 Tomcat 5.5.0 to 5.5.27 Tomcat 6.0.0 to 6.0.18 The unsupported Tomcat 3.x, 4.0.x and...

JVN#87272440: Apache Tomcat denial of service (DoS) vulnerability

Apache Tomcat from the Apache Software Foundation is an implementation of the Java Servlet and JavaServer Page JSP technologies. If Tomcat receives a request with an invalid header via the Java AJP connector, it will not return an error and instead closes the AJP connection. In case this connecto...