Apache Jakarta Tomcat 3 URL parsing vulnerability

OVERVIEW ======== Tomcat is a JSP/Servlet implementation developed at the Apache Software Foundation. Tomcat versions 3.3.1 and earlier contain some security vulnerabilities which allow a remote user to retrieve listings of directories despite index.html or index.jsp files. It is also possible to...

CVE-2003-0042

CVE-2003-0042 affects Apache Jakarta Tomcat up to version 3.3.1a when used with JDK 1.3.1 or earlier. The vulnerability lets remote attackers cause directory listings and disclose JSP/source via a URL containing a null character, bypassing index.html or other welcome-file safeguards. Root cause i...

DSA-225 tomcat4 - source disclosure

Bulletin has no description...

CVE-2002-2009

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by 1 +/, 2 /, 3 /, and 4 %20/, which leaks the pathname in an error message...

Important: Red Hat Security Advisory: tomcat security update for Stronghold

Updated tomcat packages are now available for Stronghold Cross Platform to close a JSP source code exposure vulnerability. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. A source code exposure...

Important: Red Hat Security Advisory: tomcat security update for Stronghold

Updated tomcat packages are now available for Stronghold on Red Hat Linux Advanced Server to close a JSP source code exposure vulnerability. Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. A source code...

JSP source code exposure in Tomcat 4.x

Tomcat 4.x JSP source exposure security advisory 1. Summary Tomcat 4.0.4 and 4.1.10 probably all other earlier versions also are vulnerable to source code exposure by using the default servlet org.apache.catalina.servlets.DefaultServlet. 2. Details: Let say you have valid URL like...

Unauthorizaed Apache Tomcat JSP source code disclosure

org.apache.catalina.servlets.DefaultServ let allows to access any JSP code...

Fixed in Apache Tomcat 4.1.12, 4.0.5

Important: Information disclosure CVE-2002-1148 A specially crafted URL using the default servlet can enable an attacker to obtain the source of JSP pages. Affects: 4.0.0-4.0.4, 4.1.0-4.1.11...

Apache Tomcat 3/4 - 'DefaultServlet' File Disclosure

source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes JSP source code, which may contain sensitive data...

Apache Tomcat 34 - DefaultServlet File Disclosure

Apache Tomcat 34 - DefaultServlet File Disclosure source: https://www.securityfocus.com/bid/5786/info The servlet 'org.apache.catalina.servlets.DefaultServlet' is included with Apache Tomcat by default. It is possible to use this servlet to view contents of files within the webroot. This includes...

Jakarta Tomcat serves JSP source code when supplied malformed HTTP request

Overview Tomcat does not adequately validate HTTP requests and may reveal JSP source code if supplied a malformed HTTP request. Description JavaServer Pages JSP is a technology that allows for the creation of dynamic web content. The Apache Jakarta Project implementation of JSP is known as Tomcat...

CVE-2002-0936

CVE-2002-0936 affects the Java Server Pages (JSP) engine in Apache Tomcat. A JSP page that calls WPrinterJob().pageSetup(null,null) can cause a denial of service by crashing the web server. The published materials describe the vulnerability and impact but do not provide a listed fix or patch with...

Apache Tomcat 4.1 - JSP Request Cross-Site Scripting

source: https://www.securityfocus.com/bid/5542/info Jakarta Tomcat is a Java Servlet and JSP server produced by the Apache Software Foundation. Tomcat is available for Microsoft Windows, Linux, and other Unix based operating systems. A cross site scripting vulnerability has been reported in some...

CVE-2002-0565

Oracle 9iAS 1.0.2.x compiles JSP files in the pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to pages...

Source code leakage in JRun

Adding some sequences to request it's possible to obtain JSP source code...

CVE-2001-0917

The CVE-2001-0917 entry concerns Apache Tomcat 4.0.1. The provided materials confirm an information-disclosure vulnerability where remote attackers can reveal the full install path of Tomcat by requesting a long URL that ends with a .JSP extension. The issue is tied to path disclosure via crafted...

Macromedia JRun 3/4 JSP Engine - Denial of Service

source: https://www.securityfocus.com/bid/4997/info A vulnerability has been reported in Macromedia JRun for Windows that results in a denial of service condition. The vulnerability occurs when JRun encounters a malicious JSP page. The following snippet of code is reported to crash the JRun JSP...

Apache Tomcat 3/4 - JSP Engine Denial of Service

source: https://www.securityfocus.com/bid/4995/info A vulnerability has been reported in Apache Tomcat for Windows that results in a denial of service condition. The vulnerability occurs when Tomcat encounters a malicious JSP page. The following snippet of code is reported to crash the Tomcat JSP...

Apache Tomcat 34 - JSP Engine Denial of Service

Apache Tomcat 34 - JSP Engine Denial of Service source: https://www.securityfocus.com/bid/4995/info A vulnerability has been reported in Apache Tomcat for Windows that results in a denial of service condition. The vulnerability occurs when Tomcat encounters a malicious JSP page. The following...