tomcat5.5 - several

Fixed packages 1

Vulnerabilities 9

• Medium 5.3
  CVE-2008-5515 EPSS 19%

  Directory Traversal in Apache Tomcat

  Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass int…

  org.apache.tomcat:tomcat Maven
  Jun 16, 2009
• Medium 4.2
  CVE-2009-0783

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

  Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files…

  org.apache.tomcat:tomcat Maven
  Jun 5, 2009
• Medium —
  CVE-2009-0033 EPSS 10%

  Apache Tomcat Denial of Service via Malformed Request Headers

  Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid he…

  org.apache.tomcat:tomcat Maven
  Jun 5, 2009
• Medium —
  CVE-2009-0580 Public exploit EPSS 94%

  Exposure of Sensitive Information in Apache Tomcat

  Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to i…

  org.apache.tomcat:tomcat Maven
  Jun 5, 2009
• Medium —
  CVE-2009-0781

  Cross-site scripting in Apache Tomcat

  Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web scri…

  org.apache.tomcat:tomcat Maven
  Mar 9, 2009
• Medium —
  CVE-2009-2693

  Apache Tomcat Directory Traversal vulnerability

  Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.

  org.apache.tomcat:tomcat Maven
  Jan 28, 2010
• Medium —
  CVE-2009-2902 EPSS 11%

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat

  Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.

  org.apache.tomcat:tomcat Maven
  Jan 28, 2010
• Medium —
  CVE-2010-1157 Public exploit EPSS 53%

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

  Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field…

  org.apache.tomcat:tomcat Maven
  Apr 23, 2010
• Medium —
  CVE-2010-2227 Public exploit EPSS 55%

  Apache Tomcat does not properly handle an invalid Transfer-Encoding header

  Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a denial of service (application outage) or obtain sensitive information via a crafte…

  org.apache.tomcat:tomcat Maven
  Jul 13, 2010