Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@3.1.0
purl pkg:apache/tomcat@3.1.0
Next non-vulnerable version 4.1.3
Latest non-vulnerable version 11.0.21
Risk 10.0
Vulnerabilities affecting this package (11)
Vulnerability Summary Fixed by
VCID-1vxs-pv2f-ufam
Aliases:
CVE-2001-0829
GHSA-58hj-575g-5j25
A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, which causes the Javascript to be inserted into an error message.
3.2.2
Affected by 1 other vulnerability.
VCID-2fb2-r763-ybg5
Aliases:
CVE-2002-2006
GHSA-8g4f-fh7f-4fwh
The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.
3.3.0-a
Affected by 5 other vulnerabilities.
4.1.0
Affected by 30 other vulnerabilities.
VCID-3n3t-ygrc-wug2
Aliases:
CVE-2000-0759
GHSA-qg4g-6jcq-rw93
Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.
3.2.0
Affected by 10 other vulnerabilities.
VCID-6ss8-442a-3baf
Aliases:
CVE-2003-0044
GHSA-5hgm-qm5m-5vmw
Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.
3.3.2
Affected by 4 other vulnerabilities.
VCID-6yk2-f8d5-cyc3
Aliases:
CVE-2003-0043
GHSA-cvx5-7vc7-rg77
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.
3.3.1-a
Affected by 1 other vulnerability.
VCID-8ezk-dvv2-3qba
Aliases:
CVE-2000-0672
The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.
3.2.0
Affected by 10 other vulnerabilities.
VCID-9rpn-zb26-yfdk
Aliases:
CVE-2003-0045
GHSA-w97x-xfxf-f9xj
Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.
3.3.1
Affected by 2 other vulnerabilities.
VCID-a2q2-x613-quav
Aliases:
CVE-2001-0590
GHSA-x445-mmpw-7r4f
Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).
3.2.2
Affected by 1 other vulnerability.
VCID-edmc-muvz-5ufu
Aliases:
CVE-2000-0760
The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.
3.3.0-a
Affected by 5 other vulnerabilities.
VCID-shq7-jxup-5fgk
Aliases:
CVE-2003-0042
GHSA-qfw2-wvrw-mvw4
Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.
3.3.1-a
Affected by 1 other vulnerability.
VCID-x6zh-jypa-pbcc
Aliases:
CVE-2005-0808
Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007. There are no reported fixed by versions.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-zm3q-xjwh-xqdz Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp. CVE-2000-1210
GHSA-4gr9-99j3-vqxv

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:38:21.330007+00:00 Apache Tomcat Importer Fixing VCID-zm3q-xjwh-xqdz https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:21.302917+00:00 Apache Tomcat Importer Affected by VCID-8ezk-dvv2-3qba https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:21.279099+00:00 Apache Tomcat Importer Affected by VCID-3n3t-ygrc-wug2 https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:21.243264+00:00 Apache Tomcat Importer Affected by VCID-a2q2-x613-quav https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:21.205075+00:00 Apache Tomcat Importer Affected by VCID-1vxs-pv2f-ufam https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:21.131156+00:00 Apache Tomcat Importer Affected by VCID-edmc-muvz-5ufu https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:21.093519+00:00 Apache Tomcat Importer Affected by VCID-2fb2-r763-ybg5 https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:21.021054+00:00 Apache Tomcat Importer Affected by VCID-9rpn-zb26-yfdk https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:20.970716+00:00 Apache Tomcat Importer Affected by VCID-shq7-jxup-5fgk https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:20.920403+00:00 Apache Tomcat Importer Affected by VCID-6yk2-f8d5-cyc3 https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:20.869672+00:00 Apache Tomcat Importer Affected by VCID-6ss8-442a-3baf https://tomcat.apache.org/security-3.html 38.0.0
2026-04-01T12:38:20.749893+00:00 Apache Tomcat Importer Affected by VCID-x6zh-jypa-pbcc https://tomcat.apache.org/security-3.html 38.0.0