Org.apache.tomcat CVEs with no public exploit
154 CVEs, 16 protected by Waratek
Overview 154 matches · 16 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
16
10.4%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
138
89.6%
blocked by ARMR today
16
10.4%
partly blocked
0
0.0%
not blocked
138
89.6%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
154
100.0%
split by
peak 29 / year
20011
No exploit published1
Medium1
not blocked1
No public exploit1
20025
Protected by Waratek1
No exploit published4
High1
Medium4
blocked by ARMR today1
not blocked4
No public exploit5
20034
No exploit published4
High1
Medium3
not blocked4
No public exploit4
20040
20054
No exploit published4
High1
Medium2
Low1
not blocked4
No public exploit4
20060
20079
No exploit published9
High1
Medium6
Low2
not blocked9
No public exploit9
20083
No exploit published3
Medium3
not blocked3
No public exploit3
20095
Protected by Waratek1
No exploit published4
Medium4
Low1
blocked by ARMR today1
not blocked4
No public exploit5
20104
Protected by Waratek2
No exploit published2
Medium4
blocked by ARMR today2
not blocked2
No public exploit4
201112
Protected by Waratek1
No exploit published11
High1
Medium9
Low2
blocked by ARMR today1
not blocked11
No public exploit12
201211
No exploit published11
Medium11
not blocked11
No public exploit11
20130
20149
Protected by Waratek4
No exploit published5
High1
Medium8
blocked by ARMR today4
not blocked5
No public exploit9
20152
No exploit published2
High1
Medium1
not blocked2
No public exploit2
20165
Protected by Waratek2
No exploit published3
High1
Medium4
blocked by ARMR today2
not blocked3
No public exploit5
201713
Protected by Waratek1
No exploit published12
Critical3
High8
Medium2
blocked by ARMR today1
not blocked12
No public exploit13
20181
No exploit published1
Medium1
not blocked1
No public exploit1
20190
20203
No exploit published3
High2
Medium1
not blocked3
No public exploit3
20215
Protected by Waratek2
No exploit published3
High4
Medium1
blocked by ARMR today2
not blocked3
No public exploit5
20224
Protected by Waratek1
No exploit published3
High3
Low1
blocked by ARMR today1
not blocked3
No public exploit4
20238
No exploit published8
High5
Medium3
not blocked8
No public exploit8
20247
No exploit published7
Critical1
High2
Medium4
not blocked7
No public exploit7
202510
Protected by Waratek1
No exploit published9
High8
Medium2
blocked by ARMR today1
not blocked9
No public exploit10
202629
No exploit published29
Critical11
High11
Medium6
Low1
not blocked29
No public exploit29
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-5885 | Medium | 2012-11-17 | No exploit published | No public exploit | The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184. |
| CVE-2012-0022 | Medium | 2012-01-19 | No exploit published | No public exploit | Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858. |
| CVE-2011-3375 | Medium | 2012-01-19 | No exploit published | No public exploit | Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote attackers to obtain unintended read access to IP address and HTTP header information in opportunistic circumstances by reading TCP data. |
| CVE-2011-5064 | Medium | 2012-01-14 | No exploit published | No public exploit | DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184. |
| CVE-2011-5063 | Medium | 2012-01-14 | No exploit published | No public exploit | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184. |
| CVE-2011-5062 | Medium | 2012-01-14 | No exploit published | No public exploit | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow remote attackers to bypass intended integrity-protection requirements via a qop=auth value, a different vulnerability than CVE-2011-1184. |
| CVE-2011-1184 | Medium | 2012-01-14 | No exploit published | No public exploit | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures against replay attacks, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, related to lack of checking of nonce (aka server nonce) and nc (aka nonce-count or client nonce count) values. |
| CVE-2011-3190 | High | 2011-08-31 | No exploit published | No public exploit | Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request. |
| CVE-2011-2481 | Medium | 2011-08-15 | No exploit published | No public exploit | Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. NOTE: this vulnerability exists because of a CVE-2009-0783 regression. |
| CVE-2011-2526 | Medium | 2011-07-14 | No exploit published | No public exploit | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service (infinite loop or JVM crash) by leveraging an untrusted web application. |
| CVE-2011-2204 | Low | 2011-06-29 | No exploit published | No public exploit | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. |
| CVE-2011-1582 | Medium | 2011-05-20 | No exploit published | No public exploit | Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088, CVE-2011-1183, and CVE-2011-1419. |
| CVE-2011-1475 | Medium | 2011-04-08 | No exploit published | No public exploit | The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up of responses for requests from different users." |
| CVE-2011-1183 | Medium | 2011-04-08 | No exploit published | No public exploit | Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-1088 and CVE-2011-1419. |
| CVE-2011-1419 | Medium | 2011-03-14 | No exploit published | No public exploit | Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1088. |
| CVE-2011-1088 | Medium | 2011-03-14 | No exploit published | No public exploit | Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. |
| CVE-2011-0013 | Medium | 2011-02-19 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag. |
| CVE-2011-0534 | Medium | 2011-02-10 | No exploit published | No public exploit | Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request. |
| CVE-2010-3718 | Low | 2011-02-10 | Protected by Waratek | No public exploit | Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack. |
| CVE-2010-4312 | Medium | 2010-11-26 | No exploit published | No public exploit | The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie. |
| CVE-2009-2902 | Medium | 2010-01-28 | Protected by Waratek | No public exploit | Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename. |
| CVE-2009-2901 | Medium | 2010-01-28 | No exploit published | No public exploit | The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. |
| CVE-2009-2693 | Medium | 2010-01-28 | Protected by Waratek | No public exploit | Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry. |
| CVE-2008-5515 | Medium | 2009-06-16 | Protected by Waratek | No public exploit | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. |
| CVE-2009-0783 | Medium | 2009-06-05 | No exploit published | No public exploit | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. |
| CVE-2009-0033 | Medium | 2009-06-05 | No exploit published | No public exploit | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. |
| CVE-2009-0781 | Medium | 2009-03-09 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." |
| CVE-2008-4308 | Low | 2009-02-26 | No exploit published | No public exploit | The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request. |
| CVE-2008-1947 | Medium | 2008-06-04 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add. |
| CVE-2008-0002 | Medium | 2008-02-12 | No exploit published | No public exploit | Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception. |
| CVE-2007-6286 | Medium | 2008-02-12 | No exploit published | No public exploit | Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request. |
| CVE-2007-5342 | Medium | 2007-12-27 | No exploit published | No public exploit | The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler. |
| CVE-2007-4724 | Medium | 2007-09-05 | No exploit published | No public exploit | Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters. |
| CVE-2007-3385 | Medium | 2007-08-14 | No exploit published | No public exploit | Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. |
| CVE-2007-3384 | Medium | 2007-08-08 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages. |
| CVE-2007-3383 | Medium | 2007-07-25 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages. |
| CVE-2007-2450 | Low | 2007-06-14 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors. |
| CVE-2007-1358 | Low | 2007-05-10 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616". |
| CVE-2006-7195 | Medium | 2007-05-10 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values. |
| CVE-2006-7197 | High | 2007-04-25 | No exploit published | No public exploit | The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory. |
| CVE-2005-4836 | High | 2005-12-31 | No exploit published | No public exploit | The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information. |
| CVE-2005-3510 | Medium | 2005-11-06 | No exploit published | No public exploit | Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files. |
| CVE-2005-3164 | Low | 2005-10-06 | No exploit published | No public exploit | The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages. |
| CVE-2005-2090 | Medium | 2005-07-05 | No exploit published | No public exploit | Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling." |
| CVE-2003-0045 | Medium | 2003-02-07 | No exploit published | No public exploit | Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp. |
| CVE-2003-0044 | Medium | 2003-02-07 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML. |
| CVE-2003-0043 | Medium | 2003-02-07 | No exploit published | No public exploit | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file. |
| CVE-2002-1394 | High | 2003-01-17 | No exploit published | No public exploit | Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148. |
| CVE-2002-2009 | Medium | 2002-12-31 | No exploit published | No public exploit | Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message. |
| CVE-2002-2008 | Medium | 2002-12-31 | No exploit published | No public exploit | Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message. |
| CVE-2002-0935 | Medium | 2002-10-04 | No exploit published | No public exploit | Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang. |
| CVE-2002-0493 | High | 2002-08-12 | No exploit published | No public exploit | Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions. |
| CVE-2000-1210 | Medium | 2002-03-22 | Protected by Waratek | No public exploit | Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp. |
| CVE-2001-0917 | Medium | 2001-11-22 | No exploit published | No public exploit | Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension. |