CVE-2007-3382

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

CVE-2007-3385

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

CVE-2007-3386

Cross-site scripting XSS vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action...

CVE-2007-3385

CVE-2007-3385 affects Apache Tomcat: multiple branches (6.0.x, 5.5.x, 4.1.x, 3.3.x) fail to sanitize the " character sequence and similar encoded sequences in cookie values, potentially leaking session IDs and enabling session hijacking. Affected versions include 6.0.0–6.0.14 (and 5.5.0–5.5.25, 4...

CVE-2007-3385

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

CVE-2007-3382

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

CVE-2007-3386

CVE-2007-3386 is a cross-site scripting (XSS) vulnerability in the Host Manager Servlet of Apache Tomcat, affected in Tomcat 6.0.0–6.0.13 and 5.5.0–5.5.24. An attacker can inject arbitrary HTML/script by sending crafted requests, demonstrated via the aliases parameter to an html/add action. Conne...

CVE-2007-3382

The CVE-2007-3382 issue affects multiple Apache Tomcat releases (Tomcat 6.0.0–6.0.13, 5.5.0–5.5.24, 5.0.0–5.0.30, 4.1.0–4.1.36, 3.3–3.3.2). The root cause is that Tomcat treats the single quote (') as a delimiter in cookies, which can lead to leakage of sensitive data such as session IDs and enab...

CVE-2007-3386: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action...

CVE-2007-3386: XSS in Host Manager

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 CVE-2007-3386: XSS in Host Manager Severity: Low Cross-site scripting Vendor: The Apache Software Foundation Versions Affected: 6.0.0 to 6.0.13 5.5.0 to 5.5.24 Description: The Host Manager Servlet does not filter user supplied data before display. Th...

Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure

source: https://www.securityfocus.com/bid/25316/info Apache Tomcat is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data. Attackers can exploit these issues to access potentially sensitive data that may aid in further attacks...

Apache Tomcat fails to properly handle cookies containing single quotes

Overview Apache Tomcat fails to properly handle cookies that contain a single quote, which may allow session hijacking. Description Apache Tomcat is an implementation of the Java Servlet and JavaServer Page JSP technologies. Apache Tomcat incorrectly treats a single quote as a cookie delimiter...

Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure

Apache Tomcat 6.0.13 - Insecure Cookie Handling Quote Delimiter Session ID Disclosure source: https://www.securityfocus.com/bid/25316/info Apache Tomcat is prone to multiple information-disclosure vulnerabilities because it fails to adequately sanitize user-supplied data. Attackers can exploit...

Apache Tomcat < 5.5.25 / 6.0.x < 6.0.14 Multiple Vulnerabilities

Binary data 4167.prm...

CVE-2007-3385: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the " character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks...

CVE-2007-3382: Exposure of Sensitive Information to an Unauthorized Actor

Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes "'" as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks...

Apache Tomcat 6.0.13 - Host Manager Servlet Cross-Site Scripting

Apache Tomcat 6.0.13 - Host Manager Servlet Cross-Site Scripting source: https://www.securityfocus.com/bid/25314/info Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit...

Apache Tomcat 6.0.13 - Host Manager Servlet Cross-Site Scripting

source: https://www.securityfocus.com/bid/25314/info Apache Tomcat Host Manager Servlet is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. An attacker can exploit this vulnerability to inject HTML and script code into the brows...

Fixed in Apache Tomcat 6.0.14

Low: Cross-site scripting CVE-2007-2449 JSPs within the examples web application did not escape user provided data before including it in the output. This enabled a XSS attack. These JSPs now filter the data before use. This issue may be mitigated by undeploying the examples web application. Note...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the 1 Name or 2 Value field, related to error messages...