Show filters
20 Total Results
Displaying 11-20 of 20
Sort by:
Attacker Value
Unknown
CVE-2007-1355
Disclosure Date: May 21, 2007 (last updated October 04, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
0
Attacker Value
Unknown
CVE-2007-1358
Disclosure Date: May 10, 2007 (last updated October 04, 2023)
Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
0
Attacker Value
Unknown
CVE-2006-7196
Disclosure Date: May 10, 2007 (last updated November 08, 2023)
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
0
Attacker Value
Unknown
CVE-2003-0866
Disclosure Date: November 17, 2003 (last updated February 22, 2025)
The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
0
Attacker Value
Unknown
CVE-2002-1394
Disclosure Date: January 17, 2003 (last updated February 22, 2025)
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
0
Attacker Value
Unknown
CVE-2002-2272
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
0
Attacker Value
Unknown
CVE-2002-2009
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
0
Attacker Value
Unknown
CVE-2002-2006
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
0
Attacker Value
Unknown
CVE-2002-1148
Disclosure Date: October 11, 2002 (last updated February 22, 2025)
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
0
Attacker Value
Unknown
CVE-2001-0917
Disclosure Date: November 22, 2001 (last updated February 22, 2025)
Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension.
0
