PT-2006-7520 · Apache · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.1.28 through 4.1.31 Apache Tomcat versions 5.0.0 through 5.0.30 Apache Tomcat versions 5.5.0 through 5.5.17 Description: The default SSL cipher configuration uses certain insecure ciphers, including the anonymous...

Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability

Exploit for multiple platform in category remote exploits ============================================================= Apache Tomcat 5.5.17 Remote Directory Listing Vulnerability ============================================================= ScanAlert Security Advisory - http://www.scanalert.com...

PT-2006-7515 · Apache · Apache Tomcat

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 4.0.0 through 4.0.6 Apache Tomcat versions 4.1.0 through 4.1.31 Apache Tomcat versions 5.0.0 through 5.0.30 Apache Tomcat versions 5.5.0 through 5.5.15 Description: The issue is related to a cross-site scripting XSS...

Fixed in Apache Tomcat 5.5.16, 5.0.SVN

Low: Cross-site scripting CVE-2006-7196 The calendar application included as part of the JSP examples is susceptible to a cross-site scripting attack as it does not escape user provided data before including it in the returned page. Affects: 5.0.0-5.0.30, 5.5.0-5.5.15...

Moderate: Red Hat Security Advisory: RHAPS security and enhancement update

Red Hat Application Server Release 2 Update 1 is now available. This update contains an upgrade of several RHAPS components to newer releases, including JOnAS 4.6.3, Tomcat 5.5.12 and Struts 1.2.8. This update has been rated as having moderate security impact by the Red Hat Security Response Team...

CVE-2005-4703

CVE-2005-4703 affects Apache Tomcat 4.0.3 on Windows. When a request targets a file whose name matches an MS-DOS device name (e.g., lpt9), the server may disclose the pathname in an error message (demonstrated by lpt9.xtp, e.g., via Nikto). Root cause: improper handling of MS-DOS device names lea...

CVE-2005-4703: Undefined Security Weakness

Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto...

CVE-2005-1753

ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to sourc...

CVE-2005-4703

Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto...

CVE-2005-4836

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information...

CVE-2005-1754

JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not...

CVE-2005-3510

CVE-2005-3510 affects Apache Tomcat 5.5.0–5.5.11, allowing a DoS via a huge number of simultaneous directory-list requests, causing CPU exhaustion. The Red Hat advisory RHSA-2010:0602 notes remediation by upgrading the Tomcat component in Red Hat Certificate System to version 5.5.23. Other OSV en...

CVE-2005-3510: Undefined Security Weakness

Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service CPU consumption via a large number of simultaneous requests to list a web directory that has a large number of files...

Apache Tomcat application server DoS

Large number of listing requests cause server to hang...

[Full-disclosure] Apache Tomcat 5.5.x remote Denial Of Service

Apache Tomcat is the famous servlet container for Java Servlet and JSP technologies released under ASL. Version 5.5.x is intented for servlet/jsp specification 2.4/2.0. More information on http://tomcat.apache.org/ Description: Many time consuming directory listing requests can cause a denial of...

Fixed in Apache Tomcat 4.1.32

Low: Information disclosure CVE-2008-3271 Bug 25835 can, in rare circumstances - this has only been reproduced using a debugger to force a particular processing sequence for two threads - allow a user from a non-permitted IP address to gain access to a context that is protected with a valve that...

Fixed in Apache Tomcat 5.5.13, 5.0.SVN

Low: Directory listing CVE-2006-3835 This is expected behaviour when directory listings are enabled. The semicolon ; is the separator for path parameters so inserting one before a file name changes the request into a request for a directory with a path parameter. If directory listings are enabled...

Non-Existent Page Physical Path Disclosure Vulnerability (HTTP)

The remote web server is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2003 Michel Arboi SPDX-FileCopyrightText: Improved / extended code / detection routine since 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright ...

Apache Tomcat DOS Device Name XSS

The remote Apache Tomcat web server is vulnerable to a cross site scripting issue. SPDX-FileCopyrightText: 2002 Matt Moore Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Netware 6.0 Tomcat source code viewer

The Apache Tomcat server distributed with Netware 6.0 has a directory traversal vulnerability. SPDX-FileCopyrightText: 2004 David Kyger Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only C...