Apache Tomcat 3.2.3/3.2.4 - 'RealPath.jsp' Information Disclosuree

source: https://www.securityfocus.com/bid/4878/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the realPath.jsp page is accessed, it may...

Apache Tomcat 3.2.33.2.4 - Source.jsp Information Disclosure

Apache Tomcat 3.2.33.2.4 - Source.jsp Information Disclosure source: https://www.securityfocus.com/bid/4876/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server...

Apache Tomcat 3.2.33.2.4 - RealPath.jsp Information Disclosuree

Apache Tomcat 3.2.33.2.4 - RealPath.jsp Information Disclosuree source: https://www.securityfocus.com/bid/4878/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web serve...

Apache Tomcat 3.2.33.2.4 - Example Files Web Root Full Path Disclosure

Apache Tomcat 3.2.33.2.4 - Example Files Web Root Full Path Disclosure source: https://www.securityfocus.com/bid/4877/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. When Apache Tomcat is installed with a default configuration, several example...

Apache Tomcat 3.2.3/3.2.4 - Example Files Web Root Full Path Disclosure

source: https://www.securityfocus.com/bid/4877/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. When Apache Tomcat is installed with a default configuration, several example files are also installed. When some of these example files are request...

Apache Tomcat 3.2.3/3.2.4 - 'Source.jsp' Information Disclosure

source: https://www.securityfocus.com/bid/4876/info Apache Tomcat is a freely available, open source web server maintained by the Apache Foundation. Under some circumstances, Tomcat may yield sensitive information about the web server configuration. When the source.jsp page is passed a malformed...

Apache Tomcat 4.04.1 - Servlet Full Path Disclosure

Apache Tomcat 4.04.1 - Servlet Full Path Disclosure source: https://www.securityfocus.com/bid/4575/info Apache Tomcat is a servlet container for use with the Java Servlet and JavaServer Pages technologies. Tomcat may be run on most UNIX and Linux variants as well as Microsoft Windows. Apache Tomc...

Apache Tomcat 4.0/4.1 - Servlet Full Path Disclosure

source: https://www.securityfocus.com/bid/4575/info Apache Tomcat is a servlet container for use with the Java Servlet and JavaServer Pages technologies. Tomcat may be run on most UNIX and Linux variants as well as Microsoft Windows. Apache Tomcat ships with a number of example classes SnoopServl...

Fixed in Apache Tomcat 4.0.0

Moderate: Security manager bypass CVE-2002-0493 If errors are encountered during the parsing of web.xml and Tomcat is configured to use a security manager it is possible for Tomcat to start without the security manager in place. Affects: Pre-release builds of 4.0.0...

CVE-2000-1210

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. dot dot in the argument to source.jsp...

CVE-2001-0590

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification i.e. HTTP/1.0...

Fixed in Apache Tomcat 3.2.4

Moderate: Information disclosure CVE-2001-1563 No specifics are provided in the vulnerability report. This may be a summary of other issues reported against 3.2.x Affects: 3.2?, 3.2.1, 3.2.2-3.2.3?...

CVE-2001-0829

A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message...

Apache Tomcat Nonexistent File Error Message Path Disclosure

Tomcat will reveal the physical path of the webroot when asked for a nonexistent .jsp file. An unauthenticated, remote attacker can exploit this via a specially crafted request. An attacker can use this flaw to gain further knowledge about the remote filesystem layout. %NASLMINLEVEL 70300 C Tenab...

CVE-2001-0829

Apache Tomcat 3.x is affected by a cross-site scripting vulnerability (CVE-2001-0829) in which a malicious user can craft a request for a JSP file so that the default error page echoes the user-supplied input without proper escaping. The root cause is the error page displaying unvalidated URLs, a...

CVE-2001-0829

A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message...

Fixed in Apache Tomcat 4.0.2

Low: Information disclosure CVE-2002-2009, CVE-2001-0917 Requests for JSP files where the file name is preceded by '+/', '/', '/' or '%20/' or a request for a JSP with a long file name would result in in an error page that included the full file system path to the JSP file. Affects: 4.0.0-4.0.1...

Apache Tomcat vulnerable to Cross-Site Scripting via passing of user input directly to default error page

Overview Web Servers that use the Apache Tomcat Java Servlet Container are vulnerable to a cross-site scripting vulnerability. A web site may inadvertently include malicious HTML tags or scriptJavaScript, VBScript, Java, etc. in a dynamically generated page based on unvalidated input from...

CVE-2001-0590

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification i.e. HTTP/1.0...

Fixed in Apache Tomcat 3.2.2

Moderate: Cross site scripting CVE-2001-0829 The default 404 error page does not escape URLs. This allows XSS attacks using specially crafted URLs. Affects: 3.0, 3.1-3.1.1, 3.2-3.2.1 Moderate: Information disclosure CVE-2001-0590 A specially crafted URL can be used to obtain the source for JSPs...