Tomcat@4.0.3 Security Vulnerabilities and Issues — Tomcat@4.0.3 CVE List

Lucene search

ApacheTomcat4.0.3

23 matches found

CVE•added 2014/02/26 2:55 p.m.•894 views

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration...

4.3CVSS8.8AI score0.01173EPSS

CVE•added 2013/11/13 3:55 p.m.•756 views

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?...

6.8CVSS7AI score0.00603EPSS

CVE•added 2014/02/26 2:55 p.m.•719 views

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-...

5.8CVSS9.3AI score0.8199EPSS

CVE•added 2014/02/26 2:55 p.m.•655 views

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial...

4.3CVSS9.1AI score0.67322EPSS

CVE•added 2007/10/18 10:0 a.m.•260 views

CVE-2002-2272

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

7.8CVSS6.7AI score0.18434EPSS

CVE•added 2007/10/15 6:17 p.m.•175 views

CVE-2007-5461

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

3.5CVSS5.7AI score0.07173EPSS

CVE•added 2007/06/14 11:30 p.m.•136 views

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via...

4.3CVSS7.1AI score0.89189EPSS

CVE•added 2009/11/12 11:30 p.m.•109 views

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

7.5CVSS7.8AI score0.88795EPSS

CVE•added 2007/05/10 12:19 a.m.•99 views

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unsp...

4.3CVSS5.5AI score0.76559EPSS

CVE•added 2007/05/10 12:19 a.m.•88 views

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

2.6CVSS7.6AI score0.51554EPSS

CVE•added 2009/04/09 3:8 p.m.•82 views

CVE-2008-5519

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST ...

2.6CVSS5.6AI score0.05777EPSS

CVE•added 2007/05/21 8:30 p.m.•77 views

CVE-2007-1355

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the ...

4.3CVSS8AI score0.78989EPSS

CVE•added 2007/06/14 11:30 p.m.•77 views

CVE-2007-2450

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web scri...

3.5CVSS6.6AI score0.00393EPSS

CVE•added 2004/09/01 4:0 a.m.•65 views

CVE-2002-0682

Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.

7.5CVSS6.5AI score0.68706EPSS

CVE•added 2007/07/25 5:30 p.m.•65 views

CVE-2007-3383

Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, rel...

4.3CVSS5.5AI score0.36592EPSS

CVE•added 2003/11/17 5:0 a.m.•64 views

CVE-2003-0866

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

5CVSS6.3AI score0.20413EPSS

CVE•added 2004/09/01 4:0 a.m.•62 views

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

7.5CVSS6.5AI score0.39379EPSS

CVE•added 2004/09/01 4:0 a.m.•57 views

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

5CVSS6.4AI score0.39379EPSS

CVE•added 2002/10/04 4:0 a.m.•56 views

CVE-2002-0936

The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).

5CVSS6.8AI score0.08273EPSS

CVE•added 2005/07/14 4:0 a.m.•55 views

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

5CVSS6.1AI score0.32359EPSS

CVE•added 2005/07/14 4:0 a.m.•46 views

CVE-2002-2008

Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.

5CVSS6.4AI score0.07149EPSS

CVE•added 2003/04/02 5:0 a.m.•44 views

CVE-2002-0935

Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.

5CVSS6.7AI score0.02448EPSS

CVE•added 2006/02/01 8:0 p.m.•43 views

CVE-2005-4703

Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.

5CVSS6.1AI score0.18347EPSS