Maven package
org.apache.tomcat/tomcat
pkg:maven/org.apache.tomcat/tomcat
Vulnerabilities (148)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2011-2204 | — | >= 5.5.0, < 5.5.34 | 5.5.34 | Jun 29, 2011 | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file | ||
| CVE-2011-1582 | — | >= 7.0.12, < 7.0.14 | 7.0.14 | May 20, 2011 | Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists | ||
| CVE-2011-1475 | — | >= 7.0.0, < 7.0.12 | 7.0.12 | Apr 8, 2011 | The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up | ||
| CVE-2011-1183 | — | >= 7.0.11, < 7.0.12 | 7.0.12 | Apr 8, 2011 | Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an inco | ||
| CVE-2011-1419 | — | >= 7.0, < 7.0.11 | 7.0.11 | Mar 14, 2011 | Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an inco | ||
| CVE-2011-1088 | — | >= 7.0.0, < 7.0.10 | 7.0.10 | Mar 14, 2011 | Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. | ||
| CVE-2011-0013 | — | >= 5.5.0, < 5.5.32 | 5.5.32 | Feb 19, 2011 | Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag. | ||
| CVE-2010-4476 | — | >= 7.0.0, < 7.0.7 | 7.0.7 | Feb 17, 2011 | The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denia | ||
| CVE-2011-0534 | — | >= 6.0.0, < 6.0.32 | 6.0.32 | Feb 10, 2011 | Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request. | ||
| CVE-2010-3718 | — | >= 7.0.0, < 7.0.4 | 7.0.4 | Feb 10, 2011 | Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a director | ||
| CVE-2010-4312 | — | >= 6.0.0, < 6.0.35 | 6.0.35 | Nov 26, 2010 | The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie. | ||
| CVE-2010-4172 | — | >= 7.0.0, < 7.0.5 | 7.0.5 | Nov 26, 2010 | Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecifie | ||
| CVE-2010-2227 | — | >= 7.0.0, < 7.0.2 | 7.0.2 | Jul 13, 2010 | Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interfe | ||
| CVE-2010-1157 | — | >= 5.5.0, < 5.5.30 | 5.5.30 | Apr 23, 2010 | Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authentic | ||
| CVE-2009-2902 | — | >= 5.5.0, < 5.5.29 | 5.5.29 | Jan 28, 2010 | Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename. | ||
| CVE-2009-2901 | — | >= 5.5.0, < 5.5.29 | 5.5.29 | Jan 28, 2010 | The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. | ||
| CVE-2009-2693 | — | >= 5.5.0, < 5.5.29 | 5.5.29 | Jan 28, 2010 | Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry. | ||
| CVE-2009-3555 | Cri | 9.8 | >= 7.0.0, < 7.0.10 | 7.0.10 | Nov 9, 2009 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and | |
| CVE-2008-5515 | — | >= 4.1.0, < 4.1.40 | 4.1.40 | Jun 16, 2009 | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrict | ||
| CVE-2009-0783 | Med | 4.2 | >= 4.1.0, <= 4.1.39 | — | Jun 5, 2009 | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web app |
- CVE-2011-2204Jun 29, 2011affected >= 5.5.0, < 5.5.34fixed 5.5.34
Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file
- CVE-2011-1582May 20, 2011affected >= 7.0.12, < 7.0.14fixed 7.0.14
Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests. NOTE: this vulnerability exists
- CVE-2011-1475Apr 8, 2011affected >= 7.0.0, < 7.0.12fixed 7.0.12
The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in opportunistic circumstances by examining the application data in HTTP packets, related to "a mix-up
- CVE-2011-1183Apr 8, 2011affected >= 7.0.11, < 7.0.12fixed 7.0.12
Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP requests to a meta-data complete web application. NOTE: this vulnerability exists because of an inco
- CVE-2011-1419Mar 14, 2011affected >= 7.0, < 7.0.11fixed 7.0.11
Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application. NOTE: this vulnerability exists because of an inco
- CVE-2011-1088Mar 14, 2011affected >= 7.0.0, < 7.0.10fixed 7.0.10
Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web application.
- CVE-2011-0013Feb 19, 2011affected >= 5.5.0, < 5.5.32fixed 5.5.32
Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML, as demonstrated via the display-name tag.
- CVE-2010-4476Feb 17, 2011affected >= 7.0.0, < 7.0.7fixed 7.0.7
The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denia
- CVE-2011-0534Feb 10, 2011affected >= 6.0.0, < 6.0.32fixed 6.0.32
Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote attackers to cause a denial of service (OutOfMemoryError) via a crafted request.
- CVE-2010-3718Feb 10, 2011affected >= 7.0.0, < 7.0.4fixed 7.0.4
Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a director
- CVE-2010-4312Nov 26, 2010affected >= 6.0.0, < 6.0.35fixed 6.0.35
The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script access to a cookie.
- CVE-2010-4172Nov 26, 2010affected >= 7.0.0, < 7.0.5fixed 7.0.5
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecifie
- CVE-2010-2227Jul 13, 2010affected >= 7.0.0, < 7.0.2fixed 7.0.2
Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafted header that interfe
- CVE-2010-1157Apr 23, 2010affected >= 5.5.0, < 5.5.30fixed 5.5.30
Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authentic
- CVE-2009-2902Jan 28, 2010affected >= 5.5.0, < 5.5.29fixed 5.5.29
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
- CVE-2009-2901Jan 28, 2010affected >= 5.5.0, < 5.5.29fixed 5.5.29
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
- CVE-2009-2693Jan 28, 2010affected >= 5.5.0, < 5.5.29fixed 5.5.29
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
- affected >= 7.0.0, < 7.0.10fixed 7.0.10
The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4 and
- CVE-2008-5515Jun 16, 2009affected >= 4.1.0, < 4.1.40fixed 4.1.40
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrict
- affected >= 4.1.0, <= 4.1.39
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web app
Page 5 of 8