TO
Web Server
Tomcat
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 31High 89Medium 43Low 4
Watch
Add Tomcat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2007-3384 | – | Aug 8 | Multiple cross-site scripting (XSS) vulnerabilities in examples/servlet/CookieExample in Apache Tomcat 3.3 through 3.3.2 allow remote attackers to inject arbitrary web script or… Affected: 3.3; 3.3.1; 3.3.1a; 3.3.2 |
| CVE-2007-3383 | – | Jul 25 | Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +11 more |
| CVE-2007-2450 | – | Jun 14 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2007-2449 | – | Jun 14 | Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through… Affected: through 4.1.36; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +34 more |
| CVE-2007-1355 | – | May 21 | Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2006-7195 | – | May 10 | Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web… Affected: 5.0.0; 5.0.1; 5.0.2; 5.0.10; 5.0.11; 5.0.12; +31 more |
| CVE-2006-7196 | – | May 10 | Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through… Affected: through 4.1.31; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +34 more |
| CVE-2007-1358 | – | May 10 | Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web… Affected: through 4.1.31; 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; +3 more |
| CVE-2007-1858 | – | May 10 | The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous… Affected: 4.1.28; 4.1.31; 5.0.0; 5.0.1; 5.0.2; 5.0.10; +34 more |
| CVE-2006-7197 | – | Apr 25 | The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the ajp_process_callback in mod_jk, which allows remote… Affected: 5.5.15 |
| CVE-2007-0450 | – | Mar 16 | Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk),… Affected: 5.0.0 before 5.5.22; 6.0.0 before 6.0.10 |
| CVE-2006-3835 | – | Jul 25 | Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with… Affected: 5.0.28; 5.5.7; 5.5.9; 5.5.12; 5.5.16 |
| CVE-2005-1754 | – | Dec 31 | JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter Affected: 5.0.16 |
| CVE-2005-4836 | – | Dec 31 | The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source… Affected: 4.1.15; 4.1.16; 4.1.17; 4.1.18; 4.1.19; 4.1.20; +20 more |
| CVE-2005-4838 | – | Dec 31 | Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or… Affected: through 5.5.6 |
| CVE-2005-4703 | – | Dec 31 | Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9,… Affected: 4.0.3 |
| CVE-2005-3510 | – | Nov 6 | Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +6 more |
| CVE-2005-3164 | – | Oct 6 | The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a… Affected: 4.0.1 through 4.0.6; 4.1.0 through 4.1.36 |
| CVE-2005-2090 | – | Jul 5 | Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS… Affected: 4.1.24; 5.0.19 |
| CVE-2005-0808 | – | May 2 | Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007 Affected: 3.0; 3.1; 3.1.1; 3.2; 3.2.1; 3.2.2; +5 more |
| CVE-2003-0866 | – | Nov 17 | The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +1 more |
| CVE-2002-1567 | – | Oct 6 | Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by… Affected: 4.1.0 |
| CVE-2003-0042 | – | Feb 7 | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed… Affected: 3.0; 3.1; 3.1.1; 3.2; 3.2.1; 3.2.3; +3 more |
| CVE-2003-0045 | – | Feb 7 | Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page… Affected: 3.0; 3.1; 3.1.1; 3.2; 3.2.1; 3.2.3; +3 more |
| CVE-2003-0044 | – | Feb 7 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert… Affected: 3.0; 3.1; 3.1.1; 3.2; 3.2.1; 3.2.3; +4 more |
| CVE-2003-0043 | – | Feb 7 | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of… Affected: 3.0; 3.1; 3.1.1; 3.2; 3.2.1; 3.2.3; +3 more |
| CVE-2002-1394 | – | Jan 17 | Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +4 more |
| CVE-2002-2006 | – | Dec 31 | The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via… Affected: 3.0; 3.1; 3.1.1; 3.2; 3.2.1; 3.2.3; +8 more |
| CVE-2002-2272 | – | Dec 31 | Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +9 more |
| CVE-2002-2009 | – | Dec 31 | Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname… Affected: 4.0.1 |
| CVE-2002-1895 | – | Dec 31 | The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number… Affected: 3.3; 4.0.4 |
| CVE-2002-2008 | – | Dec 31 | Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the… Affected: 4.0.3 |
| CVE-2002-2007 | – | Dec 31 | The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via… Affected: 3.2.3; 3.2.4 |
| CVE-2002-1148 | – | Oct 11 | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct… Affected: 3.0; 3.1; 3.1.1; 3.2; 3.2.1; 3.2.2; +13 more |
| CVE-2002-0936 | – | Oct 4 | The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls… Affected: 4.0.3 |
| CVE-2002-0935 | – | Oct 4 | Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to… Affected: 4.0.3 |
| CVE-2002-0493 | – | Aug 12 | Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions Affected: through 3.3.2 |
| CVE-2002-0682 | – | Jul 23 | Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does… Affected: 4.0.3 |
| CVE-2000-1210 | – | Mar 22 | Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a Affected: through 3.1 |
| CVE-2001-1563 | – | Dec 31 | Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources Affected: 3.2.1 |
| CVE-2001-0829 | – | Dec 6 | A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be… Affected: 3.2.1 |
| CVE-2001-0917 | – | Nov 22 | Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension Affected: 4.0.1 |
| CVE-2001-0590 | – | Aug 2 | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end… Affected: through 3.2.2 |
| CVE-2000-0759 | – | Oct 20 | Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the… Affected: 3.1 |
| CVE-2000-0760 | – | Oct 20 | The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension Affected: 3.0; 3.1 |
| CVE-2000-0672 | – | Jul 20 | The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the… Affected: 3.0; 3.1 |