org.apache.tomcat CVEs · Protected by Waratek · Low

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5

2matches 0exploited0.0% 0CISA KEV0.0% 1public PoC50.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%

Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 2 100.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 1 50.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 1 50.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q4 071 Protected by Waratek1 Low1 blocked by ARMR today1 Working exploit published1 Q1 080 Q2 080 Q3 080 Q4 080 Q1 090 Q2 090 Q3 090 Q4 090 Q1 100 Q2 100 Q3 100 Q4 100 Q1 111 Protected by Waratek1 Low1 blocked by ARMR today1 No public exploit1

Q1 08Q3 08Q1 09Q3 09Q1 10Q3 10Q1 11

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2010-3718	Low	2011-02-10	Protected by Waratek	No public exploit	Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
CVE-2007-5461	Low	2007-10-15	Protected by Waratek	Working exploit published	Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2010-3718

Low

2011-02-10

Protected by Waratek

No public exploit

Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.

CVE-2007-5461

Low

2007-10-15

Protected by Waratek

Working exploit published

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.