WaratekVRT Sign in
Reset
More filters (3)
Columns
Published from 2011-02-01✕Published to 2011-02-28✕Vendor org.apache.tomcat✕
Overview 4 matches · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
4matches 1protected25.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC25.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 25.0% Rule in development 0 0.0% Mitigation candidate 1 25.0% No exploit published 2 50.0%
Critical 0 0.0% High 0 0.0% Medium 3 75.0% Low 1 25.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 25.0% partly blocked 0 0.0% not blocked 3 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 25.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 4 / month
No exploit published: 2Mitigation candidate: 1Protected by Waratek: 1 Low: 1Medium: 3 not blocked: 3blocked by ARMR today: 1 No public exploit: 3Working exploit published: 1
Feb 114 Protected by Waratek1 Mitigation candidate1 No exploit published2 Medium3 Low1 blocked by ARMR today1 not blocked3 Working exploit published1 No public exploit3
Feb 11
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2011-0013 Medium 2011-02-19 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
CVE-2010-4476 Medium 2011-02-17 Mitigation candidate Working exploit published The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.
CVE-2011-0534 Medium 2011-02-10 No exploit published No public exploit Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
CVE-2010-3718 Low 2011-02-10 Protected by Waratek No public exploit Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.