Skip to content
OpenAdvisories

Package · Maven

org.apache.tomcat:tomcat

168 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

168 results · Feed

  • High —
    CVE-2002-0493

    Apache Tomcat may be started without proper security settings

    Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2002-0935

    Apache Tomcat DoS Via Requests Including Null Characters

    Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustion) via a large number of requests to the server with null characters, which causes the working threads to hang.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2000-1210

    Apache Tomcat Directory Traversal

    Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2003-0042 Public exploit EPSS 46%

    Jakarta Tomcat Directory Listing vulnerability

    Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2003-0044

    Jakarta Tomcat cross-site scripting (XSS) vulnerability

    Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2001-0917

    Apache Tomcat Reveals Path through Long URL

    Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2001-0829 EPSS 12%

    Apache Tomcat allows webmasters to insert xss into error messages

    A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.

    org.apache.tomcat:tomcat Maven
  • Medium —
    CVE-2000-0759 Public exploit EPSS 26%

    Jakarta Apache Tomcat Reveals Physical Paths

    Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.

    org.apache.tomcat:tomcat Maven