CentOS 6 : tomcat6 (CESA-2011:1780)

Updated tomcat6 packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

CentOS Update for tomcat5 CESA-2011:1845 centos5 i386

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

tomcat6 security update

CentOS Errata and Security Advisory CESA-2011:1780 Updated tomcat6 packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring Syst...

CentOS 5 : tomcat5 (CESA-2011:1845)

Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

tomcat5 security update

CentOS Errata and Security Advisory CESA-2011:1845 Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS bas...

tomcat: file permission bypass flaw

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attac...

tomcat: XSS vulnerability in HTML Manager interface

Multiple cross-site scripting XSS vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag...

Moderate: Red Hat Security Advisory: tomcat5 security update

Updated tomcat5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...

Apache Tomcat 7.0.0 < 7.0.22 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 7.0.22. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat7.0.22security-7 advisory. - Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching an...

Apache Tomcat 6.x < 6.0.35 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 6.x listening on the remote host is prior to 6.0.35. It is, therefore, affected by multiple vulnerabilities : - Specially crafted requests are incorrectly processed by Tomcat and can cause the server to allow injection o...

Moderate: Red Hat Security Advisory: tomcat6 security and bug fix update

Updated tomcat6 packages that fix several security issues and one bug are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

tomcat: authentication bypass and information disclosure

Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret...

PT-2012-2041

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.11 Description The issue is related to the HTTP Digest Access Authentication implementation, which does not check real...

PT-2011-5195

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.34 Apache Tomcat versions 6.x through 6.0.33 Apache Tomcat versions 7.x through 7.0.22 Description The issue allows remote attackers to cause a denial of service due to CPU consumption via a request...

PT-2012-2042

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.11 Description The issue concerns the HTTP Digest Access Authentication implementation in Apache Tomcat, where the...

PT-2011-4413

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 6.0.30 through 6.0.33 Apache Tomcat versions 7.x before 7.0.22 Description The issue arises from improper caching and recycling operations involving request objects, allowing remote attackers to obtain unintended read...

PT-2012-2040

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 5.5.x through 5.5.33 Apache Tomcat versions 6.x through 6.0.32 Apache Tomcat versions 7.x through 7.0.11 Description The issue is related to the HTTP Digest Access Authentication implementation, which does not check qop...

Important: tomcat6

Issue Overview: Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the...

Fixed in Apache Tomcat 7.0.23

Important: Denial of service CVE-2012-0022 Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to...

Apache Tomcat 4.x < 4.1.36 Multiple Vulnerabilities

According to its self-reported version number, the instance of Apache Tomcat 4.x listening on the remote host is prior to 4.1.36. It is, therefore, affected by the following vulnerabilities : - Requests containing multiple 'content-length' headers are not rejected as invalid. This error can allow...