Skip to content
OpenAdvisories

Package · Maven

org.apache.tomcat:tomcat

168 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

46 results · Clear filters · Feed

  • Low —
    CVE-2002-2006 Public exploit EPSS 31%

    Apache Tomcat Default Installation Reveals Sensitive Information

    The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2002-1148 Public exploit EPSS 19%

    Apache Tomcat Source Code Disclosure

    The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2003-0866 Public exploit EPSS 35%

    Apache Tomcat Denial of Service vulnerability in the Catalina package

    The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2002-1567 Public exploit EPSS 27%

    Apache Tomcat XSS Vulnerability

    Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2003-0042 Public exploit EPSS 46%

    Jakarta Tomcat Directory Listing vulnerability

    Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2000-0759 Public exploit EPSS 26%

    Jakarta Apache Tomcat Reveals Physical Paths

    Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.

    org.apache.tomcat:tomcat Maven