TO
Web Server
Tomcat
On CISA KEVExploited in the wildRansomware-linked
296
CVEs
7
On KEV
9.8
Max CVSS
8
New 30D
Severity mix
Critical 31High 89Medium 43Low 4
Watch
Add Tomcat to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-3375 | – | Jan 19 | Apache Tomcat 6.0.30 through 6.0.33 and 7.x before 7.0.22 does not properly perform certain caching and recycling operations involving request objects, which allows remote… Affected: 6.0.30; 6.0.31; 6.0.32; 6.0.33; 7.0.0; 7.0.1; +20 more |
| CVE-2011-5064 | – | Jan 14 | DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2011-5063 | – | Jan 14 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2011-5062 | – | Jan 14 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check qop values, which might allow… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2011-1184 | – | Jan 14 | The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not have the expected countermeasures… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2011-4858 | – | Jan 5 | Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions… Affected: 5.5.35; 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; +34 more |
| CVE-2011-3376 | – | Nov 11 | org/apache/catalina/core/DefaultInstanceManager.java in Apache Tomcat 7.x before 7.0.22 does not properly restrict ContainerServlets in the Manager application, which allows local… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +17 more |
| CVE-2011-3190 | – | Aug 31 | Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, 5.5.0 through 5.5.33, and possibly other versions allow remote… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +34 more |
| CVE-2011-2729 | – | Aug 15 | native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and… Affected: 5.5.32; 5.5.33; 6.0.30; 6.0.31; 6.0.32; 7.0.0; +18 more |
| CVE-2011-2481 | – | Aug 15 | Apache Tomcat 7.0.x before 7.0.17 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml,… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +10 more |
| CVE-2011-2526 | – | Jul 14 | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2011-2204 | – | Jun 29 | Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.17, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2011-1582 | – | May 20 | Apache Tomcat 7.0.12 and 7.0.13 processes the first request to a servlet without following security constraints that have been configured through annotations, which allows remote… Affected: 7.0.12; 7.0.13 |
| CVE-2011-1475 | – | Apr 8 | The HTTP BIO connector in Apache Tomcat 7.0.x before 7.0.12 does not properly handle HTTP pipelining, which allows remote attackers to read responses intended for other clients in… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +7 more |
| CVE-2011-1183 | – | Apr 8 | Apache Tomcat 7.0.11, when web.xml has no login configuration, does not follow security constraints, which allows remote attackers to bypass intended access restrictions via HTTP… Affected: 7.0.11 |
| CVE-2011-1419 | – | Mar 14 | Apache Tomcat 7.x before 7.0.11, when web.xml has no security constraints, does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +6 more |
| CVE-2011-1088 | – | Mar 14 | Apache Tomcat 7.x before 7.0.10 does not follow ServletSecurity annotations, which allows remote attackers to bypass intended access restrictions via HTTP requests to a web… Affected: 7.0.0; 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; +5 more |
| CVE-2011-0013 | – | Feb 18 | Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32, 6.0 before 6.0.30, and 7.0 before 7.0.6 allow remote… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +34 more |
| CVE-2010-3718 | – | Feb 10 | Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 6.0; 6.0.0; +34 more |
| CVE-2011-0534 | – | Feb 10 | Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce the maxHttpHeaderSize limit for requests involving the NIO HTTP connector, which allows remote… Affected: 7.0.0; 7.0.1; 7.0.2; 7.0.3; 7.0.4; 7.0.5; +28 more |
| CVE-2010-4312 | – | Nov 26 | The default configuration of Apache Tomcat 6.x does not include the HTTPOnly flag in a Set-Cookie header, which makes it easier for remote attackers to hijack a session via script… Affected: 6.0; 6.0.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; +21 more |
| CVE-2010-4172 | – | Nov 26 | Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject… Affected: 6.0.12; 6.0.13; 6.0.14; 6.0.15; 6.0.16; 6.0.17; +14 more |
| CVE-2009-2696 | – | Aug 5 | Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop… Affected: through 4.1.39 |
| CVE-2010-2227 | – | Jul 13 | Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 beta does not properly handle an invalid Transfer-Encoding header, which allows remote attackers to cause a… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2010-1157 | – | Apr 23 | Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2009-2902 | – | Jan 28 | Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2009-2901 | – | Jan 28 | The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy,… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2009-2693 | – | Jan 28 | Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +34 more |
| CVE-2009-3548 | – | Nov 12 | The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which… Affected: 3.0; 3.1; 3.1.1; 3.2; 3.2.1; 3.2.2; +34 more |
| CVE-2008-5515 | – | Jun 16 | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.10; 4.1.11; +34 more |
| CVE-2009-0580 | – | Jun 5 | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.3; 4.1.4; +34 more |
| CVE-2009-0033 | – | Jun 5 | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.3; 4.1.4; +34 more |
| CVE-2008-5519 | – | Apr 9 | The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2009-0781 | – | Mar 9 | Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.3; 4.1.4; +34 more |
| CVE-2008-4308 | – | Feb 26 | The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause… Affected: 4.1.32; 4.1.33; 4.1.34; 5.5.10; 5.5.11; 5.5.12; +8 more |
| CVE-2008-3271 | – | Oct 13 | Apache Tomcat 5.5.0 and 4.1.0 through 4.1.31 allows remote attackers to bypass an IP address restriction and obtain sensitive information via a request that is processed… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.3; 4.1.4; +28 more |
| CVE-2008-2938 | – | Aug 13 | Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote… Affected: 4.0.0 through 4.1.37; 5.0.0 through 5.5.26; 6.0.0 through 6.0.16 |
| CVE-2008-1232 | – | Aug 4 | Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web… Affected: 4.1.0 through 4.1.37; 5.5.0 through 5.5.26; 6.0.0 through 6.0.16 |
| CVE-2008-2370 | – | Aug 4 | Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +34 more |
| CVE-2008-1947 | – | Jun 4 | Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via the name… Affected: 5.5.9; 5.5.10; 5.5.11; 5.5.12; 5.5.13; 5.5.14; +29 more |
| CVE-2007-6286 | – | Feb 12 | Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native APR connector is used, does not properly handle an empty request to the SSL port, which allows remote… Affected: 5.5.11; 5.5.12; 5.5.13; 5.5.14; 5.5.15; 5.5.16; +25 more |
| CVE-2008-0002 | – | Feb 12 | Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote… Affected: 6.0.5; 6.0.6; 6.0.7; 6.0.8; 6.0.9; 6.0.10; +5 more |
| CVE-2007-5333 | – | Feb 12 | Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash)… Affected: 4.1.0 through 4.1.36; 5.5.0 through 5.5.25; 6.0.0 through 6.0.14 |
| CVE-2008-0128 | – | Jan 23 | The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https… Affected: through 5.5.20 |
| CVE-2007-5342 | – | Dec 27 | The default catalina.policy in the JULI logging component in Apache Tomcat 5.5.9 through 5.5.25 and 6.0.0 through 6.0.15 does not restrict certain permissions for web… Affected: 5.5.9; 5.5.10; 5.5.11; 5.5.12; 5.5.13; 5.5.14; +27 more |
| CVE-2007-5461 | – | Oct 15 | Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows… Affected: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.0.5; +34 more |
| CVE-2007-4724 | – | Sep 5 | Cross-site request forgery (CSRF) vulnerability in cal2.jsp in the calendar examples application in Apache Tomcat 4.1.31 allows remote attackers to add events as arbitrary users… Affected: 4.1.31 |
| CVE-2007-3386 | – | Aug 14 | Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web… Affected: 5.5.0; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +33 more |
| CVE-2007-3385 | – | Aug 14 | Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 does not properly handle the \" character sequence in a cookie value, which… Affected: 3.3; 3.3.1; 3.3.1a; 3.3.2; 4.1.0; 4.1.1; +34 more |
| CVE-2007-3382 | – | Aug 14 | Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes ("'") as delimiters in cookies, which might cause sensitive… Affected: 3.3; 3.3.1; 3.3.1a; 3.3.2; 4.1.0; 4.1.1; +34 more |