Fixed in Apache Tomcat 6.0.10

Important: Directory traversal CVE-2007-0450 Tomcat permits '', '%2F' and '%5C' as path delimiters. When Tomcat is used behind a proxy including, but not limited to, Apache HTTP server with modproxy and modjk configured to only proxy some contexts, a HTTP request containing strings like "/\../"...

Fixed in Apache Tomcat 6.0.9

Moderate: Session hi-jacking CVE-2008-0128 When using the SingleSignOn Valve via https the Cookie JSESSIONIDSSO is transmitted without the "secure" attribute, resulting in it being transmitted to any content that is - by purpose or error - requested via http from the same server. Affects:...

Symantec Backup Exec System Recovery Manager 7.0 - FileUpload Class Unauthorized File Upload

Symantec Backup Exec System Recovery Manager 7.0 - FileUpload Class Unauthorized File Upload source: https://www.securityfocus.com/bid/27487/info Symantec Backup Exec System Recovery Manager is prone to a vulnerability that allows arbitrary unauthorized files to be uploaded to any location on the...

Fixed in Apache Tomcat 6.0.6

Low: Cross-site scripting CVE-2007-1358 Web pages that display the Accept-Language header value sent by the client are susceptible to a cross-site scripting attack if they assume the Accept-Language header value conforms to RFC 2616. Under normal circumstances this would not be possible to exploi...

CVE-2006-3835

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon ; preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do...

CVE-2006-3835

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon ; preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do...

CVE-2006-3835

CVE-2006-3835 affects Apache Tomcat 5 before 5.5.17. The vulnerability allows remote attackers to list directories by using a semicolon before a filename with a mapped extension, as shown by URLs like /;index.jsp or /;help.do. The initial description confirms the condition; related advisories (GH...

CVE-2006-3835: Undefined Security Weakness

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon ; preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do...

Apache Tomcat < 5.5.17 Remote Directory Listing Vulnerability

No description provided by source. ScanAlert Security Advisory - http://www.scanalert.com Directory Listing in Apache Tomcat 5.x.x Date: 07/21/2006 Vendor: Apache Package: Tomcat Versions: 5.x.x 5.0.28, 5.5.12, 5.5.9, and 5.5.7 . Confirmed Credit: ScanAlert.s Enterprise Services Team. Overview:...

Apache Tomcat 5.5.17 - Remote Directory Listing

Apache Tomcat 5.5.17 - Remote Directory Listing ScanAlert Security Advisory - http://www.scanalert.com Directory Listing in Apache Tomcat 5.x.x Date: 07/21/2006 Vendor: Apache Package: Tomcat Versions: 5.x.x 5.0.28, 5.5.12, 5.5.9, and 5.5.7 . Confirmed Credit: ScanAlert.s Enterprise Services Team...

Apache Tomcat < 5.5.17 - Remote Directory Listing

ScanAlert Security Advisory - http://www.scanalert.com Directory Listing in Apache Tomcat 5.x.x Date: 07/21/2006 Vendor: Apache Package: Tomcat Versions: 5.x.x 5.0.28, 5.5.12, 5.5.9, and 5.5.7 . Confirmed Credit: ScanAlert.s Enterprise Services Team. Overview: Apache Tomcat is the servlet contain...

Apache Tomcat 5 - Information Disclosure

Apache Tomcat 5 - Information Disclosure source: https://www.securityfocus.com/bid/19106/info Apache Tomcat is prone to an information-disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to reveal a complete directory listing from...

Apache Tomcat 5 - Information Disclosure

source: https://www.securityfocus.com/bid/19106/info Apache Tomcat is prone to an information-disclosure vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to reveal a complete directory listing from any directory. Information obtained may...

SOL5790 - Security Advisory: Apache JServ Protocol vulnerability - JVN#79314822

Apache Tomcat, an implementation of the Java Servlet and JavaServer Pages technologies, contains a vulnerability in processing specific requests. Information about this advisory is available at the following location:...

CVE-2005-1753

CVE-2005-1753 affects JavaMail API versions 1.1.3 through 1.3, used by Apache Tomcat 5.0.16. The ReadMessage.jsp component allows remote attackers to view other users’ email attachments via direct requests to /mailboxesdir/username@domainname. Sun and Apache dispute the issue, stating published r...

CVE-2005-1753

ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to sourc...

CVE-2005-1754

JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not...

CVE-2005-1754

CVE-2005-1754 affects JavaMail API 1.1.3–1.3 used by Apache Tomcat 5.0.16, allowing remote attackers to read arbitrary files via a full pathname in the Download parameter. Sun and Apache dispute the report, noting references to source code/files that do not exist. Public documents do not provide ...

CVE-2005-1754: Exposure of Sensitive Information to an Unauthorized Actor

JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to source code and files that do not...

CVE-2005-1753: Undefined Security Weakness

ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname. NOTE: Sun and Apache dispute this issue. Sun states: "The report makes references to sourc...