Overview 9 matches · 1 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
1
11.1%
Rule in development
0
0.0%
Mitigation candidate
4
44.4%
No exploit published
4
44.4%
blocked by ARMR today
1
11.1%
partly blocked
0
0.0%
not blocked
8
88.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
4
44.4%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
5
55.6%
split by
peak 5 / quarter
Q4 001
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
Q1 010
Q2 010
Q3 011
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
Q4 011
No exploit published1
Medium1
not blocked1
No public exploit1
Q1 021
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
Q2 020
Q3 020
Q4 025
Mitigation candidate2
No exploit published3
Medium5
not blocked5
Working exploit published2
No public exploit3
Q4 00Q1 01Q2 01Q3 01Q4 01Q1 02Q2 02Q3 02Q4 02
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2002-2009 | Medium | 2002-12-31 | No exploit published | No public exploit | Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message. |
| CVE-2002-2008 | Medium | 2002-12-31 | No exploit published | No public exploit | Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message. |
| CVE-2002-2006 | Medium | 2002-12-31 | Mitigation candidate | Working exploit published | The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets. |
| CVE-2002-1148 | Medium | 2002-10-11 | Mitigation candidate | Working exploit published | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. |
| CVE-2002-0935 | Medium | 2002-10-04 | No exploit published | No public exploit | Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang. |
| CVE-2000-1210 | Medium | 2002-03-22 | Protected by Waratek | No public exploit | Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp. |
| CVE-2001-0917 | Medium | 2001-11-22 | No exploit published | No public exploit | Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension. |
| CVE-2001-0590 | Medium | 2001-08-02 | Mitigation candidate | Working exploit published | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0). |
| CVE-2000-0759 | Medium | 2000-10-20 | Mitigation candidate | Working exploit published | Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path. |