Apache Tomcat 3.0 - Directory Traversal

source: https://www.securityfocus.com/bid/2518/info Apache Tomcat in a Windows NT environment could be led to traverse the normal directory structure and return requested files from outside of the document root. By including '/../' sequences along with specially chosen characters in requested URL...

Apache Tomcat 3.0 - Directory Traversal

Apache Tomcat 3.0 - Directory Traversal source: https://www.securityfocus.com/bid/2518/info Apache Tomcat in a Windows NT environment could be led to traverse the normal directory structure and return requested files from outside of the document root. By including '/../' sequences along with...

Apache Tomcat Snoop Servlet Remote Information Disclosure

The 'snoop' Tomcat servlet is installed. This servlet gives too much information about the remote host, such as the PATHs in use, the host kernel version, etc. A remote attacker can exploit this to gain more knowledge about the host, allowing an attacker to conduct further attacks. %NASLMINLEVEL...

Apache Tomcat contextAdmin Arbitrary File Access

The page /admin/contextAdmin/contextAdmin.html can be accessed. An attacker can exploit this to read arbitrary files. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid10477; scriptversion"1.33"; scriptcvsdate"Date: 2018/08/03 11:35:08"; scriptcveid"CVE-2000-0672";...

Fixed in Apache Tomcat 3.2

Low: Information disclosure CVE-2000-0759 Requesting a JSP that does not exist results in an error page that includes the full file system page of the current context. Affects: 3.1 Important: Information disclosure CVE-2000-0672 Access to the admin context is not protected. This context allows an...

Apache Tomcat 3.1 - Path Revealing

Apache Tomcat 3.1 - Path Revealing source: https://www.securityfocus.com/bid/1531/info A vulnerability exists in the JSP portion of the Tomcat package, version 3.1, from the Apache Software Foundation. Upon hitting an nonexistent JSP file, too much information is presented by the server as part o...

Fixed in Apache Tomcat 3.3a

Moderate: Information disclosure CVE-2002-2007 Non-standard requests to the sample applications installed by default could result in unexpected directory listings or disclosure of the full file system path for a JSP. Affects: 3.2.3-3.2.4 Low: Information disclosure CVE-2002-2006, CVE-2000-0760 Th...

Security bug in Apache project: Jakarta Tomcat

The Apache project: Jakarta Tomcat contains a serius security bug. Tomcat is used together with the Apache web server to serve Java Server Pages and Java servlets. Summary from the Tomcat development team advisory is posted below: Advisory: Delivered with Tomcat is an example jsp/source.jsp that...

Fixed in Apache Tomcat 3.1

Important: Information disclosure CVE-2000-1210 source.jsp, provided as part of the examples, allows an attacker to read arbitrary files via a .. dot dot in the argument to source.jsp. Affects: 3.0...