WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2016-05-31✕Vendor org.apache.tomcat✕
Overview 15 matches · 0 exploited · 0 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
15matches 0exploited0.0% 0CISA KEV0.0% 4public PoC26.7% 2EPSS ≥ 0.513.3%
Protected by Waratek 15 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 1 6.7% Medium 12 80.0% Low 2 13.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 15 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 4 26.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 11 73.3%
split by peak 4 / year
Protected by Waratek: 15 Low: 2Medium: 12High: 1 blocked by ARMR today: 15 No public exploit: 11Working exploit published: 4
20021 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20031 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20040 20050 20060 20071 Protected by Waratek1 Low1 blocked by ARMR today1 Working exploit published1 20082 Protected by Waratek2 Medium2 blocked by ARMR today2 Working exploit published2 20091 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20102 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20111 Protected by Waratek1 Low1 blocked by ARMR today1 No public exploit1 20120 20130 20144 Protected by Waratek4 High1 Medium3 blocked by ARMR today4 No public exploit4 20150 20162 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2
20022004200620082010201220142016
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2015-5345 Medium 2016-02-25 Protected by Waratek No public exploit The Mapper component in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.30, and 9.x before 9.0.0.M2 processes redirects before considering security constraints and Filters, which allows remote attackers to determine the existence of a directory via a URL that lacks a trailing / (slash) character.
CVE-2015-5174 Medium 2016-02-25 Protected by Waratek No public exploit Directory traversal vulnerability in RequestUtil.java in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.65, and 8.x before 8.0.27 allows remote authenticated users to bypass intended SecurityManager restrictions and list a parent directory via a /.. (slash dot dot) in a pathname used by a web application in a getResource, getResourceAsStream, or getResourcePaths call, as demonstrated by the $CATALINA_BASE/webapps directory.
CVE-2014-0119 Medium 2014-05-31 Protected by Waratek No public exploit Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
CVE-2014-0096 Medium 2014-05-31 Protected by Waratek No public exploit java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2013-4590 Medium 2014-02-26 Protected by Waratek No public exploit Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2013-2185 High 2014-01-19 Protected by Waratek No public exploit The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue
CVE-2010-3718 Low 2011-02-10 Protected by Waratek No public exploit Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
CVE-2009-2902 Medium 2010-01-28 Protected by Waratek No public exploit Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
CVE-2009-2693 Medium 2010-01-28 Protected by Waratek No public exploit Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
CVE-2008-5515 Medium 2009-06-16 Protected by Waratek No public exploit Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.
CVE-2008-2938 Medium 2008-08-13 Protected by Waratek Working exploit published Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
CVE-2008-2370 Medium 2008-08-04 Protected by Waratek Working exploit published Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
CVE-2007-5461 Low 2007-10-15 Protected by Waratek Working exploit published Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
CVE-2003-0042 Medium 2003-02-07 Protected by Waratek Working exploit published Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
CVE-2000-1210 Medium 2002-03-22 Protected by Waratek No public exploit Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.