CVE-2002-0493

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions...

CVE-2002-0682

Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet...

Apache Tomcat TroubleShooter Servlet Information Disclosure

The default installation of Apache Tomcat includes various sample JSP pages and servlets. One of these, the 'TroubleShooter' servlet, discloses Tomcat's installation directory when accessed directly. %NASLMINLEVEL 70300 This script was written by Matt Moore Script audit and contributions from...

wp-02-0008: Apache Tomcat Cross Site Scripting

Westpoint Security Advisory Title: Apache Tomcat Cross Site Scripting Risk Rating: Low Software: Apache Tomcat v4.0.3 Platforms: WinNT, Win2k, Linux Vendor URL: jakarta.apache.org Author: Matt Moore [email protected] Date: 10th July 2002 Advisory ID: wp-02-0008 Overview: ========= Apache Tomc...

Apache Tomcat 4.0.3 - Denial of Service Device Name Cross-Site Scripting

Apache Tomcat 4.0.3 - Denial of Service Device Name Cross-Site Scripting source: https://www.securityfocus.com/bid/5194/info A vulnerability has been reported for Apache Tomcat 4.0.3 on a Microsoft Windows platform. Reportedly, it is possible for an attacker to launch a cross site scripting attac...

Apache Tomcat 4.0.3 - Denial of Service 'Device Name' / Cross-Site Scripting

source: https://www.securityfocus.com/bid/5194/info A vulnerability has been reported for Apache Tomcat 4.0.3 on a Microsoft Windows platform. Reportedly, it is possible for an attacker to launch a cross site scripting attack. When making a request for a DOS device file name, Tomcat will throw an...

Apache Tomcat 4.0.3 - Servlet Mapping Cross-Site Scripting

Apache Tomcat 4.0.3 - Servlet Mapping Cross-Site Scripting source: https://www.securityfocus.com/bid/5193/info A vulnerability has been reported for Apache Tomcat 4.0.3 on Microsoft Windows and Linux platforms. Reportedly, it is possible for an attacker to launch a cross site scripting attack. Wh...

Apache Tomcat DOS Device Name XSS

Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. By making requests for DOS Device names it is possible to cause Tomcat to throw an exception, allowing cross-site scripting attacks. The exception...

Apache Tomcat /servlet Mapping XSS

Apache Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. By using the /servlet/ mapping to invoke various servlets / classes it is possible to cause Tomcat to throw an exception, allowing XSS attacks...

Fixed in Apache Tomcat 4.1.13, 4.0.6

Important: Information disclosure CVE-2002-1394 A specially crafted URL using the invoker servlet in conjunction with the default servlet can enable an attacker to obtain the source of JSP pages or, under special circumstances, a static resource that would otherwise have been protected by a...

Apache Tomcat 4.0.3 - Servlet Mapping Cross-Site Scripting

source: https://www.securityfocus.com/bid/5193/info A vulnerability has been reported for Apache Tomcat 4.0.3 on Microsoft Windows and Linux platforms. Reportedly, it is possible for an attacker to launch a cross site scripting attack. When servlet mapping is enabled, it is possible to invoke...

Bugs in Apache Tomcat

Physical path disclosure, DoS...

KPMG-2002025: Apache Tomcat Denial of Service

-------------------------------------------------------------------- Title: Apache Tomcat Denial of Service BUG-ID: 2002025 Released: 20th Jun 2002 -------------------------------------------------------------------- Problem: ======== A malicious user could tie up all 75 working threads and cause...

Fixed in Apache Tomcat 4.1.3

Important: Denial of service CVE-2002-0935 A malformed HTTP request can cause the request processing thread to become unresponsive. A sequence of such requests will cause all request processing threads, and hence Tomcat as a whole, to become unresponsive. Affects: 4.0.0-4.0.2?, 4.0.3, 4.0.4-4.0.6...

Apache Tomcat 3/4 - JSP Engine Denial of Service

source: https://www.securityfocus.com/bid/4995/info A vulnerability has been reported in Apache Tomcat for Windows that results in a denial of service condition. The vulnerability occurs when Tomcat encounters a malicious JSP page. The following snippet of code is reported to crash the Tomcat JSP...

Apache Tomcat 34 - JSP Engine Denial of Service

Apache Tomcat 34 - JSP Engine Denial of Service source: https://www.securityfocus.com/bid/4995/info A vulnerability has been reported in Apache Tomcat for Windows that results in a denial of service condition. The vulnerability occurs when Tomcat encounters a malicious JSP page. The following...

Apache Tomcat default installation contains sample applications that disclose webroot path

Overview There is an insecure default configuration in Apache Tomcat web server that places several sample applications in the webroot. Remote users may be able to use these applications to gain sensitive information about the server's configuration. Description There are several sample...

Vulnerability in Apache Tomcat v3.23 & v3.24 (part 2)

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-06 Description: Tomcat realPath.jsp gives location of web root. Date: 8/1/2002 Application: Apache Tomcat Java server versions 3.23 and 3.24 Platform: Linux/Unix Severity: Remote attackers can obtain the location of webroot...

Vulnerability in Apache Tomcat v3.23 & v3.24

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-05 Description: Tomcat source.jsp directory listing and webroot location display Date: 8/1/2002 Application: Apache Tomcat Java server versions 3.23 and 3.24 Platform: Linux/Unix Severity: Remote attackers can obtain listings of...

Vulnerability in Apache Tomcat v3.23 & v3.24 (part 3)

Procheckup Ltd www.procheckup.com Procheckup Security Bulletin PR02-7 Description: Tomcat multiple sample files display webroot location on default configuration on request. Date: 8/1/2002 Application: Apache Tomcat java server v3.23, 3.24. Platform: Linux/Unix Severity: Remote attackers can obta...