Apache Tomcat Default Files

The default error page, default index page, example JSPs and/or example servlets are installed on the remote Apache Tomcat server. These files should be removed as they may help an attacker uncover information about the remote Tomcat install or host itself. C Tenable Network Security, Inc. Based ...

Apache Tomcat 4.0.x - Non-HTTP Request Denial of Service

Apache Tomcat 4.0.x - Non-HTTP Request Denial of Service source: https://www.securityfocus.com/bid/8824/info Apache Tomcat 4 has been reported prone to a remotely triggered denial-of-service vulnerability when handling undisclosed non-HTTP request types. When certain non-HTTP request types are...

Apache Tomcat 4.0.x - Non-HTTP Request Denial of Service

source: https://www.securityfocus.com/bid/8824/info Apache Tomcat 4 has been reported prone to a remotely triggered denial-of-service vulnerability when handling undisclosed non-HTTP request types. When certain non-HTTP request types are handled by the Tomcat HTTP connector, the Tomcat server wil...

[SECURITY] [DSA 395-1] New tomcat4 packages fix denial of service

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA 395-1 [email protected] http://www.debian.org/security/ Martin Schulze October 15th, 2003 http://www.debian.org/security/faq -...

DSA-395 tomcat4 - incorrect input handling

Bulletin has no description...

CVE-2002-1567

Cross-site scripting XSS vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script...

CVE-2002-1567

Cross-site scripting XSS vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script...

security flaw

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148...

Apache Tomcat mod_jk Invalid Transfer-Encoding Chunked Field DoS

According to the banner, the remote host is using a vulnerable version of the Apache modjk module. Such versions have a bug that could allow a remote attacker to use chunked encoding requests to desynchronize Apache and Tomcat, and therefore prevent the remote web server from working properly. C...

CVE-2000-1210

CVE-2000-1210 is a directory traversal vulnerability in the Tomcat source.jsp component prior to Apache Tomcat 3.1, allowing remote attackers to read arbitrary files by supplying a .. in the request. The issue affects the Tomcat distribution’s source.jsp endpoint and is caused by insufficient val...

CVE-2002-0493

CVE-2002-0493 affects Apache Tomcat where the web.xml parsing could proceed with errors and allow Tomcat to start with improper security settings, bypassing intended access restrictions. Affected component: Tomcat startup/security settings during web.xml read. Root cause described across sources ...

CVE-2002-0493

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions...

CVE-2002-0935

The CVE-2002-0935 issue affects Apache Tomcat 4.0.3 and possibly earlier 4.1.3 beta; it enables remote denial of service through a flood of requests containing null characters, causing server threads to hang due to resource exhaustion. The vulnerability targets the HTTP request handling path, lea...

CVE-2002-0935

Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service resource exhaustion via a large number of requests to the server with null characters, which causes the working threads to hang...

CVE-2000-1210

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. dot dot in the argument to source.jsp...

Apache Tomcat Directory Listing and File Disclosure

Apache Tomcat prior to 3.3.1a is affected by a directory listing and file disclosure vulnerability. By requesting URLs containing a null character, remote attackers can list directories even when an index.html or other file is present or obtain unprocessed source code for a JSP file. Also note...

Tomcat /status Information Disclosure

Requesting the URI '/status' gives information about the currently running instance of the remote web server most likely Apache Tomcat. It also allows anybody to reset the current statistics. A remote attacker can use this information to mount further attacks. This script was written by Vincent...

Multiple bugs in Apache Tomcat

It's possible to obtain physical path and directory listing...

Apache Tomcat multiple bugs

Multiple vulnerability allow directory browsing and source code disclosure...

Apache Tomcat 3.x - Null Byte Directory / File Disclosure

source: https://www.securityfocus.com/bid/6721/info Apache Tomcat is prone to a directory/file disclosure vulnerability when used with JDK 1.3.1 or earlier. It has been reported that remote attackers may view directory contents even when an 'index.html' or other welcome file. It is also possible...