7297 matches found
Unauthorizaed Apache Tomcat JSP source code disclosure
org.apache.catalina.servlets.DefaultServ let allows to access any JSP code...
Fixed in Apache Tomcat 4.1.12, 4.0.5
Important: Information disclosure CVE-2002-1148 A specially crafted URL using the default servlet can enable an attacker to obtain the source of JSP pages. Affects: 4.0.0-4.0.4, 4.1.0-4.1.11...
Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure
source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data...
Apache Tomcat 34 - DefaultServlet File Disclosure
Apache Tomcat 34 - DefaultServlet File Disclosure source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes...
Apache Tomcat 4.1 Cross-Site Scripting Vulnerability
This writing is part of Malloc Hackers & Malloc Security http://www.malloc.tk http://www.superw00t.com Title: Apache Tomcat 4.1 Cross-Site Scripting Vulnerability Author: Skinnay of Malloc Contact: "Skinnay" - [email protected] No modification of the contents of this file should be made without...
Crossite scripting in Apache Tomcat
It's posible to insert script in request to different servlett classes...
Apache Tomcat 4.1 - JSP Request Cross-Site Scripting
source: https://www.securityfocus.com/bid/5542/info Jakarta Tomcat is a Java Servlet and JSP server produced by the Apache Software Foundation. Tomcat is available for Microsoft Windows, Linux, and other Unix based operating systems. A cross site scripting vulnerability has been reported in some...
Fixed in Apache Tomcat 4.1.29
Moderate: Cross-site scripting CVE-2002-1567 The unmodified requested URL is included in the 404 response header. The new lines in this URL appear to the client to be the end of the header section. The remaining part of the URL, including the script elements, is treated as part of the response bo...
CVE-2002-0493
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions...
CVE-2002-0682
Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet...
Apache Tomcat TroubleShooter Servlet Information Disclosure
The default installation of Apache Tomcat includes various sample JSP pages and servlets. One of these, the 'TroubleShooter' servlet, discloses Tomcat's installation directory when accessed directly. %NASLMINLEVEL 70300 This script was written by Matt Moore Script audit and contributions from...
wp-02-0008: Apache Tomcat Cross Site Scripting
Westpoint Security Advisory Title: Apache Tomcat Cross Site Scripting Risk Rating: Low Software: Apache Tomcat v4.0.3 Platforms: WinNT, Win2k, Linux Vendor URL: jakarta.apache.org Author: Matt Moore [email protected] Date: 10th July 2002 Advisory ID: wp-02-0008 Overview: ========= Apache Tomc...
Apache Tomcat 4.0.3 - Denial of Service Device Name Cross-Site Scripting
Apache Tomcat 4.0.3 - Denial of Service Device Name Cross-Site Scripting source: https://www.securityfocus.com/bid/5194/info A vulnerability has been reported for Apache Tomcat 4.0.3 on a Microsoft Windows platform. Reportedly, it is possible for an attacker to launch a cross site scripting attac...
Apache Tomcat 4.0.3 - Denial of Service 'Device Name' / Cross-Site Scripting
source: https://www.securityfocus.com/bid/5194/info A vulnerability has been reported for Apache Tomcat 4.0.3 on a Microsoft Windows platform. Reportedly, it is possible for an attacker to launch a cross site scripting attack. When making a request for a DOS device file name, Tomcat will throw an...
Apache Tomcat 4.0.3 - Servlet Mapping Cross-Site Scripting
Apache Tomcat 4.0.3 - Servlet Mapping Cross-Site Scripting source: https://www.securityfocus.com/bid/5193/info A vulnerability has been reported for Apache Tomcat 4.0.3 on Microsoft Windows and Linux platforms. Reportedly, it is possible for an attacker to launch a cross site scripting attack. Wh...
Apache Tomcat 4.0.3 - Servlet Mapping Cross-Site Scripting
source: https://www.securityfocus.com/bid/5193/info A vulnerability has been reported for Apache Tomcat 4.0.3 on Microsoft Windows and Linux platforms. Reportedly, it is possible for an attacker to launch a cross site scripting attack. When servlet mapping is enabled, it is possible to invoke...
Fixed in Apache Tomcat 4.1.13, 4.0.6
Important: Information disclosure CVE-2002-1394 A specially crafted URL using the invoker servlet in conjunction with the default servlet can enable an attacker to obtain the source of JSP pages or, under special circumstances, a static resource that would otherwise have been protected by a...
Apache Tomcat DOS Device Name XSS
Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. By making requests for DOS Device names it is possible to cause Tomcat to throw an exception, allowing cross-site scripting attacks. The exception...
Apache Tomcat /servlet Mapping XSS
Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. By using the /servlet/ mapping to invoke various servlets / classes it is possible to cause Tomcat to throw an exception, allowing XSS attacks...