Org.apache.tomcat Servlet-api CVEs with a working exploit

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 100.0% No exploit published 0 0.0%

Critical 0 0.0% High 0 0.0% Medium 2 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 2 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q3 011 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Q4 010 Q1 020 Q2 020 Q3 020 Q4 020 Q1 030 Q2 030 Q3 030 Q4 030 Q1 040 Q2 040 Q3 040 Q4 040 Q1 050 Q2 050 Q3 050 Q4 050 Q1 060 Q2 060 Q3 060 Q4 060 Q1 070 Q2 071 Mitigation candidate1 Medium1 not blocked1 Working exploit published1

Q4 01Q2 02Q4 02Q2 03Q4 03Q2 04Q4 04Q2 05Q4 05Q2 06Q4 06Q2 07

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2007-1355	Medium	2007-05-21	Mitigation candidate	Working exploit published	Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
CVE-2001-0590	Medium	2001-08-02	Mitigation candidate	Working exploit published	Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2007-1355

Medium

2007-05-21

Mitigation candidate

Working exploit published

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

CVE-2001-0590

Medium

2001-08-02

Mitigation candidate

Working exploit published

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).