WaratekVRT Sign in

Medium Org.apache.tomcat CVEs

110 CVEs, 1 exploited, 15 protected by Waratek

Reset
More filters (1)
Columns
Vendor org.apache.tomcat✕
Overview 110 matches · 15 protected · 1 exploited · 0 CISA KEV · 27 public PoC · 13 EPSS ≥ 0.5
split by peak 12 / year
No exploit published: 73Mitigation candidate: 22Protected by Waratek: 15 Medium: 110 not blocked: 95blocked by ARMR today: 15 No public exploit: 80Forecast only: 3Proof of concept only: 2Working exploit published: 24Exploited: 1
20001 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20012 Mitigation candidate1 No exploit published1 Medium2 not blocked2 Working exploit published1 No public exploit1 20026 Protected by Waratek1 Mitigation candidate2 No exploit published3 Medium6 blocked by ARMR today1 not blocked5 Working exploit published2 No public exploit4 20036 Protected by Waratek1 Mitigation candidate2 No exploit published3 Medium6 blocked by ARMR today1 not blocked5 Working exploit published3 No public exploit3 20040 20053 Mitigation candidate1 No exploit published2 Medium3 not blocked3 Working exploit published1 No public exploit2 20061 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 200710 Mitigation candidate4 No exploit published6 Medium10 not blocked10 Working exploit published4 No public exploit6 20087 Protected by Waratek2 Mitigation candidate2 No exploit published3 Medium7 blocked by ARMR today2 not blocked5 Working exploit published4 No public exploit3 20095 Protected by Waratek1 Mitigation candidate1 No exploit published3 Medium5 blocked by ARMR today1 not blocked4 Working exploit published1 No public exploit4 20106 Protected by Waratek2 Mitigation candidate1 No exploit published3 Medium6 blocked by ARMR today2 not blocked4 Working exploit published1 Forecast only1 No public exploit4 201110 Mitigation candidate1 No exploit published9 Medium10 not blocked10 Working exploit published1 No public exploit9 201212 Mitigation candidate1 No exploit published11 Medium12 not blocked12 Working exploit published1 No public exploit11 20130 20148 Protected by Waratek3 No exploit published5 Medium8 blocked by ARMR today3 not blocked5 No public exploit8 20151 No exploit published1 Medium1 not blocked1 No public exploit1 20164 Protected by Waratek2 No exploit published2 Medium4 blocked by ARMR today2 not blocked2 No public exploit4 20172 No exploit published2 Medium2 not blocked2 No public exploit2 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20191 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20202 No exploit published2 Medium2 not blocked2 Forecast only1 No public exploit1 20212 No exploit published2 Medium2 not blocked2 Forecast only1 No public exploit1 20221 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20235 Mitigation candidate2 No exploit published3 Medium5 not blocked5 Working exploit published1 Proof of concept only1 No public exploit3 20245 Mitigation candidate1 No exploit published4 Medium5 not blocked5 Proof of concept only1 No public exploit4 20252 Protected by Waratek1 No exploit published1 Medium2 blocked by ARMR today1 not blocked1 No public exploit2 20267 Protected by Waratek1 No exploit published6 Medium7 blocked by ARMR today1 not blocked6 Working exploit published1 No public exploit6
200220052008201120142017202020232026
110 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2003-0042 Medium 2003-02-07 Protected by Waratek Working exploit published Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
CVE-2002-2009 Medium 2002-12-31 No exploit published No public exploit Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
CVE-2002-2008 Medium 2002-12-31 No exploit published No public exploit Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
CVE-2002-2006 Medium 2002-12-31 Mitigation candidate Working exploit published The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
CVE-2002-1148 Medium 2002-10-11 Mitigation candidate Working exploit published The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
CVE-2002-0935 Medium 2002-10-04 No exploit published No public exploit Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
CVE-2000-1210 Medium 2002-03-22 Protected by Waratek No public exploit Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.
CVE-2001-0917 Medium 2001-11-22 No exploit published No public exploit Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension.
CVE-2001-0590 Medium 2001-08-02 Mitigation candidate Working exploit published Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
CVE-2000-0759 Medium 2000-10-20 Mitigation candidate Working exploit published Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
‹ prev page 2 of 2 next ›