Session fixation

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

Cross site scripting

Cross-site scripting XSS vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action...

CVE-2007-3382

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

CVE-2007-3385

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

CVE-2007-3382

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

CVE-2007-3386

Cross-site scripting XSS vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action...

CVE-2007-3385

CVE-2007-3385 affects Apache Tomcat: multiple branches (6.0.x, 5.5.x, 4.1.x, 3.3.x) fail to sanitize the " character sequence and similar encoded sequences in cookie values, potentially leaking session IDs and enabling session hijacking. Affected versions include 6.0.0–6.0.14 (and 5.5.0–5.5.25, 4...

CVE-2007-3385

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

CVE-2007-3386

Cross-site scripting XSS vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action...

CVE-2007-3382

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

CVE-2007-3386

CVE-2007-3386 is a cross-site scripting (XSS) vulnerability in the Host Manager Servlet of Apache Tomcat, affected in Tomcat 6.0.0–6.0.13 and 5.5.0–5.5.24. An attacker can inject arbitrary HTML/script by sending crafted requests, demonstrated via the aliases parameter to an html/add action. Conne...

CVE-2007-3382

The CVE-2007-3382 issue affects multiple Apache Tomcat releases (Tomcat 6.0.0–6.0.13, 5.5.0–5.5.24, 5.0.0–5.0.30, 4.1.0–4.1.36, 3.3–3.3.2). The root cause is that Tomcat treats the single quote (') as a delimiter in cookies, which can lead to leakage of sensitive data such as session IDs and enab...

Apache Tomcat 6.0.13 - Host Manager Servlet Cross-Site Scripting

Apache Tomcat 6.0.13 - Host Manager Servlet Cross-Site Scripting source: https://www.securityfocus.com/bid/25314/info Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit...

Apache Tomcat < 5.5.25 / 6.0.x < 6.0.14 Multiple Vulnerabilities

Binary data 4167.prm...

CVE-2007-3385: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

CVE-2007-3386: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action...

CVE-2007-3386: XSS in Host Manager

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2007-3386: XSS in Host Manager Severity: Low Cross-site scripting Vendor: The Apache Software Foundation Versions Affected: 6.0.0 to 6.0.13 5.5.0 to 5.5.24 Description: The Host Manager Servlet does not filter user supplied data before display. Th...

Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure

Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure source: https://www.securityfocus.com/bid/25316/info Apache Tomcat is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data. Attackers can exploit...

CVE-2007-3382: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

Apache Tomcat 6.0.13 - Host Manager Servlet Cross-Site Scripting

source: https://www.securityfocus.com/bid/25314/info Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to inject HTML and script code into the brows...