Overview 12 matches · 2 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
Protected by Waratek
2
16.7%
Rule in development
0
0.0%
Mitigation candidate
2
16.7%
No exploit published
8
66.7%
blocked by ARMR today
2
16.7%
partly blocked
0
0.0%
not blocked
10
83.3%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
3
25.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
9
75.0%
split by
peak 3 / year
20051
No exploit published1
Low1
not blocked1
No public exploit1
20060
20073
Protected by Waratek1
No exploit published2
Low3
blocked by ARMR today1
not blocked2
Working exploit published1
No public exploit2
20080
20091
No exploit published1
Low1
not blocked1
No public exploit1
20103
Mitigation candidate1
No exploit published2
Low3
not blocked3
Working exploit published1
No public exploit2
20113
Protected by Waratek1
Mitigation candidate1
No exploit published1
Low3
blocked by ARMR today1
not blocked2
Working exploit published1
No public exploit2
20121
No exploit published1
Low1
not blocked1
No public exploit1
20052006200720082009201020112012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-4534 | Low | 2012-12-19 | No exploit published | No public exploit | org/apache/tomcat/util/net/NioEndpoint.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.28, when the NIO connector is used in conjunction with sendfile and HTTPS, allows remote attackers to cause a denial of service (infinite loop) by terminating the connection during the reading of a response. |
| CVE-2011-2204 | Low | 2011-06-29 | No exploit published | No public exploit | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. |
| CVE-2011-1772 | Low | 2011-05-13 | Mitigation candidate | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element. |
| CVE-2010-3718 | Low | 2011-02-10 | Protected by Waratek | No public exploit | Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack. |
| CVE-2009-4269 | Low | 2010-08-16 | No exploit published | No public exploit | The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution. |
| CVE-2010-1157 | Low | 2010-04-23 | Mitigation candidate | Working exploit published | Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply. |
| CVE-2010-0684 | Low | 2010-04-05 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action. |
| CVE-2008-4308 | Low | 2009-02-26 | No exploit published | No public exploit | The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request. |
| CVE-2007-5461 | Low | 2007-10-15 | Protected by Waratek | Working exploit published | Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag. |
| CVE-2007-2450 | Low | 2007-06-14 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors. |
| CVE-2007-1358 | Low | 2007-05-10 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616". |
| CVE-2005-3164 | Low | 2005-10-06 | No exploit published | No public exploit | The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages. |