Searching tomcat software vulnerabilities

Jakarta Tomcat 3.1 under Apache reveals physica

information | generates | attacker | includes | requests | physical | message | reveals | Jakarta | Tomcat | remote | Apache | which | exist | under | error | path | does | not | URL |

Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.


The Snoop servlet in Jakarta Tomcat 3.1 and 3.0

information | nonexistent | sensitive | extension | attacker | requests | servlet | Jakarta | reveals | remote | Tomcat | Apache | system | Snoop | under | snp | URL |

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.


A cross-site scripting vulnerability in Apache

vulnerability | cross-site | scripting | Tomcat | Apache |

A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.


Unknown vulnerability in Tomcat 3.2.1 running o

vulnerability | Unknown | Tomcat |

Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this issue is already covered by other CVE identifiers.


The Java Server Pages (JSP) engine in Tomcat al

Server | Pages | Java |

The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).


The default installation of Apache Tomcat 4.0 t

installation | through | default | Tomcat | Apache |

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.


Apache Tomcat 4.0.3 for Windows allows remote a

Tomcat | Apache |

Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, such as lpt9, which leaks the information in an error message.


Apache Tomcat 4.0.1 allows remote attackers to

Tomcat | Apache |

Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3)


Multiple cross-site scripting (XSS) vulnerabili

cross-site | scripting | Multiple |

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.


The Catalina org.apache.catalina.connector.http

orgapachecatalinaconnectorhttp | Catalina | package | Tomcat | 40x |

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.


Apache Tomcat before 5.x allows remote attacker

attackers | service | remote | denial | Apache | Tomcat | allows | before | cause |

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.


Buffer overflow in the Tomcat plugin in 4d WebS

overflow | WebSTAR | plugin | Buffer | Tomcat |

Buffer overflow in the Tomcat plugin in 4d WebSTAR 5.33 and 5.4 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long URL.


ReadMessage.jsp in JavaMail API 1.1.3 through 1

ReadMessagejsp | JavaMail | API |

ReadMessage.jsp in JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to view other users' e-mail attachments via a direct request to /mailboxesdir/username@domainname.


JavaMail API 1.1.3 through 1.3, as used by Apac

JavaMail | API |

JavaMail API 1.1.3 through 1.3, as used by Apache Tomcat 5.0.16, allows remote attackers to read arbitrary files via a full pathname in the argument to the Download parameter.


Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4

Jakarta | Tomcat |

Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."


Apache Tomcat 5.5.0 to 5.5.11 allows remote att

Tomcat | Apache |

Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.


The HTTP/1.1 connector in Apache Tomcat 4.1.15

connector | HTTP/11 | Tomcat | Apache |

The HTTP/1.1 connector in Apache Tomcat 4.1.15 and later does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information.


Apache Tomcat 5 before 5.5.17 allows remote att

before | Tomcat | Apache |

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.


Novell iManager 2.5 and 2.0.2 allows remote att

iManager | Novell |

Novell iManager 2.5 and 2.0.2 allows remote attackers to cause a denial of service (crash) in the Tomcat server via a long TREE parameter in an HTTP POST, which triggers a NULL deference.


Cross-site scripting (XSS) vulnerability in imp

Cross-site | scripting |

Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.


Software vulnerabilities results 1 to 20 of 48     
Page: 123►