CVE-2006-7196: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly...

CVE-2007-1858: Undefined Security Weakness

The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts...

CVE-2005-4836: Exposure of Sensitive Information to an Unauthorized Actor

The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information...

CVE-2006-7195: Undefined Security Weakness

Cross-site scripting XSS vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values...

Fixed in Apache Tomcat 5.5.18, 5.0.SVN

Moderate: Cross-site scripting CVE-2006-7195 The implicit-objects.jsp in the examples webapp displayed a number of unfiltered header values. This enabled a XSS attack. These values are now filtered. Affects: 5.0.0-5.0.30, 5.5.0-5.5.17...

Fixed in Apache Tomcat 5.5.21, 5.0.SVN

Low: Cross-site scripting CVE-2007-1358 Web pages that display the Accept-Language header value sent by the client are susceptible to a cross-site scripting attack if they assume the Accept-Language header value conforms to RFC 2616. Under normal circumstances this would not be possible to exploi...

tomcat DoS

Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service CPU consumption via a large number of simultaneous requests to list a web directory that has a large number of files...

tomcat XSS in example webapps

Cross-site scripting XSS vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values...

CVE-2006-7197

The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajpprocesscallback in modjk, which allows remote attackers to read portions of sensitive memory...

CVE-2006-7197

The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajpprocesscallback in modjk, which allows remote attackers to read portions of sensitive memory...

CVE-2006-7197

CVE-2006-7197 : The AJP connector in Apache Tomcat 5.5.15 (via mod_jk) has an incorrect chunk length that can cause a buffer over-read in ajp_process_callback, enabling a remote attacker to read memory portions. The linked records (e.g., GHSA-JPQR-VH55-XQXF and RHSA entries) confirm this vulnerab...

CVE-2006-7197

The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajpprocesscallback in modjk, which allows remote attackers to read portions of sensitive memory...

CVE-2006-7197: Undefined Security Weakness

The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajpprocesscallback in modjk, which allows remote attackers to read portions of sensitive memory...

Apache HTTP Server Tomcat远程目录访问漏洞

Apache Tomcat是一个流行的开放源码的JSP应用服务器程序。 Apache Tomcat在处理用户请求中的目录字串时存在漏洞，远程攻击者可能利用此漏洞访问受保护的文件。 如果将Apache HTTP服务器和Tomcat配置为与常见的代理模块（modproxy、modrewrite、modjk）交互操作的话，攻击者就可以非授权访问预期目标路径以外的目录，直至Tomcat中的Web根目录。Apache中可接受的唯一目录分隔字符是斜线（/），但Tomcat允许URI编码的字符，如“/”、“\”或“%5C”等，这允许攻击者通过特制的HTTP请求执行访问受保护的文件。 Apache...

Code injection

Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties...

CVE-2007-1491

CVE-2007-1491 affects Avaya/S87XX, S8500, and S8300 platforms running Avaya CM prior to 3.1.3, where Apache Tomcat allows external-interface connections via port 8009. This exposure can enable external access from outside networks. The vulnerability is tied to the misconfiguration/exposure of por...

CVE-2007-1491

Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties...

CVE-2007-1491: Undefined Security Weakness

Apache Tomcat in Avaya S87XX, S8500, and S8300 before CM 3.1.3, and Avaya SES allows connections from external interfaces via port 8009, which exposes it to attacks from outside parties...

Apache mod_jk Long URL Worker Map Stack Remote Overflow

According to its banner, the version of the Apache modjk module in use on the remote web server contains a buffer overflow vulnerability. An unauthenticated, remote attacker may be able to exploit this flaw by sending a long URL request to crash the affected service or execute arbitrary code on t...

Fixed in Apache Tomcat 5.5.22, 5.0.SVN

Important: Directory traversal CVE-2007-0450 The fix for this issue was insufficient. A fix was also required in the JK connector module for httpd. See CVE-2007-1860 for further information. Tomcat permits '', '%2F' and '%5C' as path delimiters. When Tomcat is used behind a proxy including, but...