CVE-2000-1210

CVE-2000-1210 is a directory traversal vulnerability in the Tomcat source.jsp component prior to Apache Tomcat 3.1, allowing remote attackers to read arbitrary files by supplying a .. in the request. The issue affects the Tomcat distribution’s source.jsp endpoint and is caused by insufficient val...

CVE-2007-4724

CVE-2007-4724 describes a CSRF vulnerability in the Apache Tomcat calendar examples app, specifically in the file cal2.jsp of the calendar example. The issue allows a remote attacker to add events as arbitrary users by supplying the time and description parameters, enabling unauthorized calendar ...

CVE-2026-34483

CVE-2026-34483 is an Improper Encoding or Escaping of Output vulnerability in the JsonAccessLogValve component of Apache Tomcat. Affected versions: Tomcat 11.0.0-M1 through 11.0.20, 10.1.0-M1 through 10.1.53, and 9.0.40 through 9.0.116. Exploitation concerns are not detailed in the provided docum...

CVE-2000-0759

The CVE-2000-0759 entry concerns Jakarta Tomcat 3.1 running under Apache, where requesting a nonexistent URL causes an error page that reveals the full physical path of the webroot. Root cause: information disclosure via error handling that leaks filesystem paths, enabling an attacker to map the ...

CVE-2002-2008

CVE-2002-2008 concerns Apache Tomcat 4.0.3 for Windows. The vulnerability allows a remote attacker to disclose the web root path by requesting a resource that does not exist (e.g., lpt9), causing the server to leak information in the error page. This is an information-disclosure in the error hand...

CVE-2011-3376

CVE-2011-3376 affects Apache Tomcat 7.x before 7.0.22. The issue is in DefaultInstanceManager.java, where ContainerServlets in the Manager application are not properly restricted, enabling local users to gain privileges by using an untrusted web application to access Manager functionality. Impact...

CVE-2001-0917

The CVE-2001-0917 entry concerns Apache Tomcat 4.0.1. The provided materials confirm an information-disclosure vulnerability where remote attackers can reveal the full install path of Tomcat by requesting a long URL that ends with a .JSP extension. The issue is tied to path disclosure via crafted...

CVE-2002-0935

The CVE-2002-0935 issue affects Apache Tomcat 4.0.3 and possibly earlier 4.1.3 beta; it enables remote denial of service through a flood of requests containing null characters, causing server threads to hang due to resource exhaustion. The vulnerability targets the HTTP request handling path, lea...

CVE-2005-4703

CVE-2005-4703 affects Apache Tomcat 4.0.3 on Windows. When a request targets a file whose name matches an MS-DOS device name (e.g., lpt9), the server may disclose the pathname in an error message (demonstrated by lpt9.xtp, e.g., via Nikto). Root cause: improper handling of MS-DOS device names lea...

CVE-2001-1563

CVE-2001-1563 refers to a vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 where attackers could access servlet resources. The vendor advisory is vague about full scope, but a public remediation exists: Apache Tomcat 3.2.4 fixes this issue. While the exact root cause isn’t deta...

CVE-2026-32990

CVE-2026-32990 is an Apache Tomcat vulnerability caused by an incomplete fix of CVE-2025-66614 (improper input validation). Affected are Tomcat 11.0.15–11.0.19, 10.1.50–10.1.52, and 9.0.113–9.0.115. Upgrading to fixed releases 11.0.20, 10.1.53, or 9.0.116 is recommended. Other connected advisorie...

CVE-2002-1895

The vulnerability CVE-2002-1895 affects the Tomcat servlet engine in versions 3.3 and 4.0.4 when used with IIS and the ajp1.3 connector. Affected component: servlet engine; issue: remote attackers can trigger a denial of service (crash) by issuing a large sequence of HTTP GET requests for MS-DOS ...

CVE-2002-2009

Affected software: Apache Tomcat 4.0.1. Vulnerability: Information disclosure where remote attackers can obtain the web root/pathname by triggering error pages for JSP requests that use a leading sequence (+/, >/,

CVE-2026-34487

CVE-2026-34487 : Apache Tomcat contains an information disclosure vulnerability titled “Insertion of Sensitive Information into Log File” in the cloud membership for the clustering component, exposing the Kubernetes bearer token. Affected versions include Tomcat 11.0.0-M1 through 11.0.20, 10.1.0-...