Show filters
52 Total Results
Displaying 41-50 of 52
Sort by:
Attacker Value
Unknown
CVE-2002-1567
Disclosure Date: October 06, 2003 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
0
Attacker Value
Unknown
CVE-2002-1394
Disclosure Date: January 17, 2003 (last updated February 22, 2025)
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
0
Attacker Value
Unknown
CVE-2002-1895
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
0
Attacker Value
Unknown
CVE-2002-2272
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.
0
Attacker Value
Unknown
CVE-2002-2009
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
0
Attacker Value
Unknown
CVE-2002-2008
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
0
Attacker Value
Unknown
CVE-2002-2006
Disclosure Date: December 31, 2002 (last updated February 22, 2025)
The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
0
Attacker Value
Unknown
CVE-2002-1148
Disclosure Date: October 11, 2002 (last updated February 22, 2025)
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
0
Attacker Value
Unknown
CVE-2002-0935
Disclosure Date: October 04, 2002 (last updated February 22, 2025)
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
0
Attacker Value
Unknown
CVE-2002-0936
Disclosure Date: October 04, 2002 (last updated February 22, 2025)
The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).
0
