WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2011-02-28✕Vendor org.apache.tomcat✕
Overview 7 matches · 2 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
7matches 2protected28.6% 0exploited0.0% 0CISA KEV0.0% 2public PoC28.6% 1EPSS ≥ 0.514.3%
Protected by Waratek 2 28.6% Rule in development 0 0.0% Mitigation candidate 1 14.3% No exploit published 4 57.1%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 7 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 28.6% partly blocked 0 0.0% not blocked 5 71.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 28.6% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 71.4%
split by peak 2 / quarter
No exploit published: 4Mitigation candidate: 1Protected by Waratek: 2 Low: 7 not blocked: 5blocked by ARMR today: 2 No public exploit: 5Working exploit published: 2
Q4 051 No exploit published1 Low1 not blocked1 No public exploit1 Q1 060 Q2 060 Q3 060 Q4 060 Q1 070 Q2 072 No exploit published2 Low2 not blocked2 No public exploit2 Q3 070 Q4 071 Protected by Waratek1 Low1 blocked by ARMR today1 Working exploit published1 Q1 080 Q2 080 Q3 080 Q4 080 Q1 091 No exploit published1 Low1 not blocked1 No public exploit1 Q2 090 Q3 090 Q4 090 Q1 100 Q2 101 Mitigation candidate1 Low1 not blocked1 Working exploit published1 Q3 100 Q4 100 Q1 111 Protected by Waratek1 Low1 blocked by ARMR today1 No public exploit1
Q1 06Q3 06Q1 07Q3 07Q1 08Q3 08Q1 09Q3 09Q1 10Q3 10Q1 11
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2010-3718 Low 2011-02-10 Protected by Waratek No public exploit Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
CVE-2010-1157 Low 2010-04-23 Mitigation candidate Working exploit published Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
CVE-2008-4308 Low 2009-02-26 No exploit published No public exploit The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
CVE-2007-5461 Low 2007-10-15 Protected by Waratek Working exploit published Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
CVE-2007-2450 Low 2007-06-14 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
CVE-2007-1358 Low 2007-05-10 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
CVE-2005-3164 Low 2005-10-06 No exploit published No public exploit The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.