WaratekVRT Sign in

Tomcat CVEs

255 CVEs, 10 exploited, 36 protected by Waratek

Reset
More filters (1)
Columns
Product tomcat✕
Overview 255 matches · 34 protected · 10 exploited · 7 CISA KEV · 57 public PoC · 36 EPSS ≥ 0.5
split by peak 40 / year
No exploit published: 178Mitigation candidate: 41Protected by Waratek: 36 Low: 12Medium: 131High: 90Critical: 22 not blocked: 219partly blocked: 2blocked by ARMR today: 34 No public exploit: 189Forecast only: 8Proof of concept only: 6Working exploit published: 42Exploited: 10
20003 Mitigation candidate2 No exploit published1 Medium3 not blocked3 Working exploit published2 No public exploit1 20013 Mitigation candidate1 No exploit published2 High1 Medium2 not blocked3 Working exploit published1 No public exploit2 200212 Protected by Waratek1 Mitigation candidate6 No exploit published5 High3 Medium9 blocked by ARMR today1 not blocked11 Working exploit published6 No public exploit6 20037 Protected by Waratek1 Mitigation candidate2 No exploit published4 High1 Medium6 blocked by ARMR today1 not blocked6 Working exploit published3 No public exploit4 20040 20057 Mitigation candidate1 No exploit published6 High1 Medium5 Low1 not blocked7 Working exploit published1 No public exploit6 20061 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 200715 Protected by Waratek1 Mitigation candidate5 No exploit published9 High1 Medium11 Low3 blocked by ARMR today1 not blocked14 Working exploit published6 No public exploit9 20089 Protected by Waratek2 Mitigation candidate2 No exploit published5 Medium9 blocked by ARMR today2 not blocked7 Working exploit published4 No public exploit5 20097 Protected by Waratek1 Mitigation candidate2 No exploit published4 High1 Medium5 Low1 blocked by ARMR today1 not blocked6 Working exploit published2 No public exploit5 20108 Protected by Waratek2 Mitigation candidate2 No exploit published4 Medium7 Low1 blocked by ARMR today2 not blocked6 Working exploit published2 Forecast only1 No public exploit5 201115 Protected by Waratek1 Mitigation candidate1 No exploit published13 High1 Medium12 Low2 blocked by ARMR today1 not blocked14 Working exploit published1 No public exploit14 201215 Mitigation candidate1 No exploit published14 Medium14 Low1 not blocked15 Working exploit published1 No public exploit14 20131 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 201411 Protected by Waratek4 Mitigation candidate1 No exploit published6 High2 Medium8 Low1 blocked by ARMR today4 not blocked7 Working exploit published1 No public exploit10 20153 No exploit published3 High1 Medium2 not blocked3 No public exploit3 201610 Protected by Waratek2 Mitigation candidate2 No exploit published6 High6 Medium4 blocked by ARMR today2 not blocked8 Working exploit published2 Forecast only1 No public exploit7 201720 Protected by Waratek5 No exploit published15 Critical4 High14 Medium2 blocked by ARMR today3 partly blocked2 not blocked15 Exploited3 Working exploit published1 Forecast only1 No public exploit15 20183 No exploit published3 High1 Medium2 not blocked3 No public exploit3 20197 Protected by Waratek3 Mitigation candidate1 No exploit published3 High5 Medium2 blocked by ARMR today3 not blocked4 Exploited1 Working exploit published1 Forecast only2 No public exploit3 20209 Protected by Waratek2 Mitigation candidate2 No exploit published5 Critical1 High6 Medium2 blocked by ARMR today2 not blocked7 Exploited1 Working exploit published2 Proof of concept only1 Forecast only2 No public exploit3 20218 Protected by Waratek3 No exploit published5 High5 Medium3 blocked by ARMR today3 not blocked5 Forecast only1 No public exploit7 20226 Protected by Waratek2 Mitigation candidate1 No exploit published3 High4 Medium1 Low1 blocked by ARMR today2 not blocked4 Exploited1 Working exploit published1 No public exploit4 202311 Mitigation candidate3 No exploit published8 High6 Medium5 not blocked11 Exploited1 Working exploit published1 Proof of concept only1 No public exploit8 202411 Mitigation candidate4 No exploit published7 Critical3 High3 Medium5 not blocked11 Exploited1 Proof of concept only3 No public exploit7 202513 Protected by Waratek4 No exploit published9 Critical1 High10 Medium2 blocked by ARMR today4 not blocked9 Exploited1 Working exploit published1 Proof of concept only1 No public exploit10 202640 Protected by Waratek2 No exploit published38 Critical13 High18 Medium8 Low1 blocked by ARMR today2 not blocked38 Exploited1 Working exploit published1 No public exploit38
200220052008201120142017202020232026
255 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2008-2370 Medium 2008-08-04 Protected by Waratek Working exploit published Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
CVE-2008-1232 Medium 2008-08-04 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.
CVE-2008-1947 Medium 2008-06-04 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name parameter (aka the hostname attribute) to host-manager/html/add.
CVE-2008-0002 Medium 2008-02-12 No exploit published No public exploit Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
CVE-2007-6286 Medium 2008-02-12 No exploit published No public exploit Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote attackers to trigger handling of "a duplicate copy of one of the recent requests," as demonstrated by using netcat to send the empty request.
CVE-2007-5333 Medium 2008-02-12 Mitigation candidate Working exploit published Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.
CVE-2008-0128 Medium 2008-01-23 No exploit published No public exploit The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.
CVE-2007-5342 Medium 2007-12-27 No exploit published No public exploit The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web applications, which allows attackers to modify logging configuration options and overwrite arbitrary files, as demonstrated by changing the (1) level, (2) directory, and (3) prefix attributes in the org.apache.juli.FileHandler handler.
CVE-2007-5461 Low 2007-10-15 Protected by Waratek Working exploit published Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
CVE-2007-4724 Medium 2007-09-05 No exploit published No public exploit Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users via the time and description parameters.
CVE-2007-3386 Medium 2007-08-14 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.
CVE-2007-3385 Medium 2007-08-14 No exploit published No public exploit Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.
CVE-2007-3382 Medium 2007-08-14 Mitigation candidate Working exploit published Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.
CVE-2007-3384 Medium 2007-08-08 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Name or (2) Value field, related to error messages.
CVE-2007-3383 Medium 2007-07-25 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.
CVE-2007-2450 Low 2007-06-14 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
CVE-2007-2449 Medium 2007-06-14 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.
CVE-2007-1355 Medium 2007-05-21 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
CVE-2007-1358 Low 2007-05-10 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
CVE-2006-7196 Medium 2007-05-10 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
CVE-2006-7195 Medium 2007-05-10 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.
CVE-2006-7197 High 2007-04-25 No exploit published No public exploit The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote attackers to read portions of sensitive memory.
CVE-2006-3835 Medium 2006-07-25 Mitigation candidate Working exploit published Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
CVE-2005-4838 Medium 2005-12-31 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.
CVE-2005-4836 High 2005-12-31 No exploit published No public exploit The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
CVE-2005-4703 Medium 2005-12-31 Mitigation candidate Working exploit published Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
CVE-2005-3510 Medium 2005-11-06 No exploit published No public exploit Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
CVE-2005-3164 Low 2005-10-06 No exploit published No public exploit The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
CVE-2005-2090 Medium 2005-07-05 No exploit published No public exploit Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVE-2005-0808 Medium 2005-05-02 No exploit published No public exploit Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.
CVE-2003-0866 Medium 2003-11-17 Mitigation candidate Working exploit published The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
CVE-2002-1567 Medium 2003-10-06 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
CVE-2003-0045 Medium 2003-02-07 No exploit published No public exploit Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.
CVE-2003-0044 Medium 2003-02-07 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.
CVE-2003-0043 Medium 2003-02-07 No exploit published No public exploit Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.
CVE-2003-0042 Medium 2003-02-07 Protected by Waratek Working exploit published Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
CVE-2002-1394 High 2003-01-17 No exploit published No public exploit Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
CVE-2002-2272 High 2002-12-31 Mitigation candidate Working exploit published Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
CVE-2002-2009 Medium 2002-12-31 No exploit published No public exploit Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
CVE-2002-2008 Medium 2002-12-31 No exploit published No public exploit Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
CVE-2002-2007 Medium 2002-12-31 Mitigation candidate Working exploit published The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.
CVE-2002-2006 Medium 2002-12-31 Mitigation candidate Working exploit published The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
CVE-2002-1895 Medium 2002-12-31 No exploit published No public exploit The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
CVE-2002-1148 Medium 2002-10-11 Mitigation candidate Working exploit published The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
CVE-2002-0936 Medium 2002-10-04 Mitigation candidate Working exploit published The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).
CVE-2002-0935 Medium 2002-10-04 No exploit published No public exploit Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
CVE-2002-0493 High 2002-08-12 No exploit published No public exploit Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
CVE-2002-0682 High 2002-07-23 Mitigation candidate Working exploit published Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
CVE-2000-1210 Medium 2002-03-22 Protected by Waratek No public exploit Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.
CVE-2001-1563 High 2001-12-31 No exploit published No public exploit Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this issue is already covered by other CVE identifiers.
CVE-2001-0917 Medium 2001-11-22 No exploit published No public exploit Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension.
CVE-2001-0590 Medium 2001-08-02 Mitigation candidate Working exploit published Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
CVE-2000-0760 Medium 2000-10-20 Mitigation candidate Working exploit published The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
CVE-2000-0759 Medium 2000-10-20 Mitigation candidate Working exploit published Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
CVE-2000-0672 Medium 2000-07-20 No exploit published No public exploit The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.
‹ prev page 3 of 3 next ›