Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension.
Max CVSS
5.0
EPSS Score
1.32%
Published
2001-11-22
Updated
2019-03-25
Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.
Max CVSS
7.5
EPSS Score
0.25%
Published
2002-08-12
Updated
2019-03-25
Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.
Max CVSS
7.5
EPSS Score
1.47%
Published
2002-07-23
Updated
2019-03-25
Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.
Max CVSS
5.0
EPSS Score
2.42%
Published
2002-10-04
Updated
2019-03-25
The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).
Max CVSS
5.0
EPSS Score
0.17%
Published
2002-10-04
Updated
2019-03-25
The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.
Max CVSS
5.0
EPSS Score
1.61%
Published
2002-10-11
Updated
2019-03-25
Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.
Max CVSS
7.5
EPSS Score
0.26%
Published
2003-01-17
Updated
2019-03-25
Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.
Max CVSS
6.8
EPSS Score
0.71%
Published
2003-10-06
Updated
2019-03-25
The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows remote attackers to cause a denial of service (crash) via a large number of HTTP GET requests for an MS-DOS device such as AUX, LPT1, CON, or PRN.
Max CVSS
5.0
EPSS Score
0.37%
Published
2002-12-31
Updated
2019-03-25
The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
Max CVSS
5.0
EPSS Score
1.82%
Published
2002-12-31
Updated
2019-03-25
Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.
Max CVSS
5.0
EPSS Score
0.37%
Published
2002-12-31
Updated
2019-03-25
Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, and (4) %20/, which leaks the pathname in an error message.
Max CVSS
5.0
EPSS Score
0.24%
Published
2002-12-31
Updated
2019-03-25
The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.
Max CVSS
5.0
EPSS Score
0.63%
Published
2003-11-17
Updated
2019-03-25
Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
Max CVSS
4.3
EPSS Score
97.19%
Published
2005-07-05
Updated
2019-04-15
The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
Max CVSS
2.6
EPSS Score
0.90%
Published
2005-10-06
Updated
2022-02-03
Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
Max CVSS
5.0
EPSS Score
1.53%
Published
2005-11-06
Updated
2019-03-25
Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
Max CVSS
5.0
EPSS Score
0.30%
Published
2005-12-31
Updated
2019-03-25
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.
Max CVSS
7.8
EPSS Score
0.10%
Published
2005-12-31
Updated
2019-03-25
Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.
Max CVSS
5.0
EPSS Score
87.07%
Published
2006-07-25
Updated
2019-03-25
Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
Max CVSS
4.3
EPSS Score
6.97%
Published
2007-05-21
Updated
2019-03-25
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!