Org.apache.tomcat CVEs
207 CVEs, 7 exploited, 30 protected by Waratek
Overview 207 matches · 29 protected · 7 exploited · 5 CISA KEV · 45 public PoC · 29 EPSS ≥ 0.5
Protected by Waratek
30
14.5%
Rule in development
0
0.0%
Mitigation candidate
32
15.5%
No exploit published
145
70.0%
blocked by ARMR today
29
14.0%
partly blocked
1
0.5%
not blocked
177
85.5%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 31 / year
20001
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20012
Mitigation candidate1
No exploit published1
Medium2
not blocked2
Working exploit published1
No public exploit1
20028
Protected by Waratek1
Mitigation candidate3
No exploit published4
High2
Medium6
blocked by ARMR today1
not blocked7
Working exploit published3
No public exploit5
20037
Protected by Waratek1
Mitigation candidate2
No exploit published4
High1
Medium6
blocked by ARMR today1
not blocked6
Working exploit published3
No public exploit4
20040
20055
Mitigation candidate1
No exploit published4
High1
Medium3
Low1
not blocked5
Working exploit published1
No public exploit4
20061
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
200714
Protected by Waratek1
Mitigation candidate4
No exploit published9
High1
Medium10
Low3
blocked by ARMR today1
not blocked13
Working exploit published5
No public exploit9
20087
Protected by Waratek2
Mitigation candidate2
No exploit published3
Medium7
blocked by ARMR today2
not blocked5
Working exploit published4
No public exploit3
20096
Protected by Waratek1
Mitigation candidate1
No exploit published4
Medium5
Low1
blocked by ARMR today1
not blocked5
Working exploit published1
No public exploit5
20107
Protected by Waratek2
Mitigation candidate2
No exploit published3
Medium6
Low1
blocked by ARMR today2
not blocked5
Working exploit published2
Forecast only1
No public exploit4
201113
Protected by Waratek1
Mitigation candidate1
No exploit published11
High1
Medium10
Low2
blocked by ARMR today1
not blocked12
Working exploit published1
No public exploit12
201212
Mitigation candidate1
No exploit published11
Medium12
not blocked12
Working exploit published1
No public exploit11
20130
201410
Protected by Waratek4
Mitigation candidate1
No exploit published5
High2
Medium8
blocked by ARMR today4
not blocked6
Working exploit published1
No public exploit9
20152
No exploit published2
High1
Medium1
not blocked2
No public exploit2
20166
Protected by Waratek2
No exploit published4
High2
Medium4
blocked by ARMR today2
not blocked4
Forecast only1
No public exploit5
201717
Protected by Waratek4
No exploit published13
Critical4
High11
Medium2
blocked by ARMR today3
partly blocked1
not blocked13
Exploited2
Working exploit published1
Forecast only1
No public exploit13
20181
No exploit published1
Medium1
not blocked1
No public exploit1
20192
Mitigation candidate1
No exploit published1
High1
Medium1
not blocked2
Working exploit published1
Forecast only1
20208
Protected by Waratek1
Mitigation candidate2
No exploit published5
High6
Medium2
blocked by ARMR today1
not blocked7
Working exploit published2
Proof of concept only1
Forecast only2
No public exploit3
20216
Protected by Waratek2
No exploit published4
High4
Medium2
blocked by ARMR today2
not blocked4
Forecast only1
No public exploit5
20226
Protected by Waratek2
Mitigation candidate1
No exploit published3
High4
Medium1
Low1
blocked by ARMR today2
not blocked4
Exploited1
Working exploit published1
No public exploit4
202311
Mitigation candidate3
No exploit published8
High6
Medium5
not blocked11
Exploited1
Working exploit published1
Proof of concept only1
No public exploit8
202411
Mitigation candidate4
No exploit published7
Critical3
High3
Medium5
not blocked11
Exploited1
Proof of concept only3
No public exploit7
202513
Protected by Waratek4
No exploit published9
Critical1
High10
Medium2
blocked by ARMR today4
not blocked9
Exploited1
Working exploit published1
Proof of concept only1
No public exploit10
202631
Protected by Waratek2
No exploit published29
Critical11
High12
Medium7
Low1
blocked by ARMR today2
not blocked29
Exploited1
Working exploit published1
No public exploit29
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2002-1148 | Medium | 2002-10-11 | Mitigation candidate | Working exploit published | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. |
| CVE-2002-0935 | Medium | 2002-10-04 | No exploit published | No public exploit | Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang. |
| CVE-2002-0493 | High | 2002-08-12 | No exploit published | No public exploit | Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions. |
| CVE-2000-1210 | Medium | 2002-03-22 | Protected by Waratek | No public exploit | Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp. |
| CVE-2001-0917 | Medium | 2001-11-22 | No exploit published | No public exploit | Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension. |
| CVE-2001-0590 | Medium | 2001-08-02 | Mitigation candidate | Working exploit published | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0). |
| CVE-2000-0759 | Medium | 2000-10-20 | Mitigation candidate | Working exploit published | Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path. |