Medium Org.apache.tomcat CVEs
110 CVEs, 1 exploited, 15 protected by Waratek
Overview 110 matches · 15 protected · 1 exploited · 0 CISA KEV · 27 public PoC · 13 EPSS ≥ 0.5
Protected by Waratek
15
13.6%
Rule in development
0
0.0%
Mitigation candidate
22
20.0%
No exploit published
73
66.4%
blocked by ARMR today
15
13.6%
partly blocked
0
0.0%
not blocked
95
86.4%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 12 / year
20001
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20012
Mitigation candidate1
No exploit published1
Medium2
not blocked2
Working exploit published1
No public exploit1
20026
Protected by Waratek1
Mitigation candidate2
No exploit published3
Medium6
blocked by ARMR today1
not blocked5
Working exploit published2
No public exploit4
20036
Protected by Waratek1
Mitigation candidate2
No exploit published3
Medium6
blocked by ARMR today1
not blocked5
Working exploit published3
No public exploit3
20040
20053
Mitigation candidate1
No exploit published2
Medium3
not blocked3
Working exploit published1
No public exploit2
20061
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
200710
Mitigation candidate4
No exploit published6
Medium10
not blocked10
Working exploit published4
No public exploit6
20087
Protected by Waratek2
Mitigation candidate2
No exploit published3
Medium7
blocked by ARMR today2
not blocked5
Working exploit published4
No public exploit3
20095
Protected by Waratek1
Mitigation candidate1
No exploit published3
Medium5
blocked by ARMR today1
not blocked4
Working exploit published1
No public exploit4
20106
Protected by Waratek2
Mitigation candidate1
No exploit published3
Medium6
blocked by ARMR today2
not blocked4
Working exploit published1
Forecast only1
No public exploit4
201110
Mitigation candidate1
No exploit published9
Medium10
not blocked10
Working exploit published1
No public exploit9
201212
Mitigation candidate1
No exploit published11
Medium12
not blocked12
Working exploit published1
No public exploit11
20130
20148
Protected by Waratek3
No exploit published5
Medium8
blocked by ARMR today3
not blocked5
No public exploit8
20151
No exploit published1
Medium1
not blocked1
No public exploit1
20164
Protected by Waratek2
No exploit published2
Medium4
blocked by ARMR today2
not blocked2
No public exploit4
20172
No exploit published2
Medium2
not blocked2
No public exploit2
20181
No exploit published1
Medium1
not blocked1
No public exploit1
20191
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20202
No exploit published2
Medium2
not blocked2
Forecast only1
No public exploit1
20212
No exploit published2
Medium2
not blocked2
Forecast only1
No public exploit1
20221
Protected by Waratek1
Medium1
blocked by ARMR today1
Exploited1
20235
Mitigation candidate2
No exploit published3
Medium5
not blocked5
Working exploit published1
Proof of concept only1
No public exploit3
20245
Mitigation candidate1
No exploit published4
Medium5
not blocked5
Proof of concept only1
No public exploit4
20252
Protected by Waratek1
No exploit published1
Medium2
blocked by ARMR today1
not blocked1
No public exploit2
20267
Protected by Waratek1
No exploit published6
Medium7
blocked by ARMR today1
not blocked6
Working exploit published1
No public exploit6
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2003-0042 | Medium | 2003-02-07 | Protected by Waratek | Working exploit published | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character. |
| CVE-2002-2009 | Medium | 2002-12-31 | No exploit published | No public exploit | Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message. |
| CVE-2002-2008 | Medium | 2002-12-31 | No exploit published | No public exploit | Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message. |
| CVE-2002-2006 | Medium | 2002-12-31 | Mitigation candidate | Working exploit published | The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets. |
| CVE-2002-1148 | Medium | 2002-10-11 | Mitigation candidate | Working exploit published | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. |
| CVE-2002-0935 | Medium | 2002-10-04 | No exploit published | No public exploit | Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang. |
| CVE-2000-1210 | Medium | 2002-03-22 | Protected by Waratek | No public exploit | Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp. |
| CVE-2001-0917 | Medium | 2001-11-22 | No exploit published | No public exploit | Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension. |
| CVE-2001-0590 | Medium | 2001-08-02 | Mitigation candidate | Working exploit published | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0). |
| CVE-2000-0759 | Medium | 2000-10-20 | Mitigation candidate | Working exploit published | Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path. |