VulnerableCode Package Details - pkg:apache/tomcat@3.3.0-a

Search for packages

Vulnerability	Summary	Fixed by
VCID-6ss8-442a-3baf Aliases: CVE-2003-0044 GHSA-5hgm-qm5m-5vmw	Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.	3.3.2 Affected by 4 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-6yk2-f8d5-cyc3 Aliases: CVE-2003-0043 GHSA-cvx5-7vc7-rg77	Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.	3.3.1-a Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-9rpn-zb26-yfdk Aliases: CVE-2003-0045 GHSA-w97x-xfxf-f9xj	Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.	3.3.1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-shq7-jxup-5fgk Aliases: CVE-2003-0042 GHSA-qfw2-wvrw-mvw4	Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.	3.3.1-a Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-x6zh-jypa-pbcc Aliases: CVE-2005-0808	Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-6ss8-442a-3baf
Aliases:
CVE-2003-0044
GHSA-5hgm-qm5m-5vmw

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

3.3.2
Affected by 4 other vulnerabilities.

VCID-6yk2-f8d5-cyc3
Aliases:
CVE-2003-0043
GHSA-cvx5-7vc7-rg77

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

3.3.1-a
Affected by 1 other vulnerability.

VCID-9rpn-zb26-yfdk
Aliases:
CVE-2003-0045
GHSA-w97x-xfxf-f9xj

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

3.3.1
Affected by 2 other vulnerabilities.

VCID-shq7-jxup-5fgk
Aliases:
CVE-2003-0042
GHSA-qfw2-wvrw-mvw4

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

3.3.1-a
Affected by 1 other vulnerability.

VCID-x6zh-jypa-pbcc
Aliases:
CVE-2005-0808

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
VCID-2fb2-r763-ybg5	The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.	CVE-2002-2006 GHSA-8g4f-fh7f-4fwh
VCID-edmc-muvz-5ufu	The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.	CVE-2000-0760
VCID-rybd-nsf5-j7fr	The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.	CVE-2002-2007

Vulnerability

Summary

Aliases

VCID-2fb2-r763-ybg5

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

CVE-2002-2006
GHSA-8g4f-fh7f-4fwh

VCID-edmc-muvz-5ufu

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

CVE-2000-0760

VCID-rybd-nsf5-j7fr

The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.

CVE-2002-2007

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-01T12:38:21.138621+00:00	Apache Tomcat Importer	Fixing	VCID-edmc-muvz-5ufu	https://tomcat.apache.org/security-3.html	38.0.0
2026-04-01T12:38:21.101897+00:00	Apache Tomcat Importer	Fixing	VCID-2fb2-r763-ybg5	https://tomcat.apache.org/security-3.html	38.0.0
2026-04-01T12:38:21.070161+00:00	Apache Tomcat Importer	Fixing	VCID-rybd-nsf5-j7fr	https://tomcat.apache.org/security-3.html	38.0.0
2026-04-01T12:38:21.029387+00:00	Apache Tomcat Importer	Affected by	VCID-9rpn-zb26-yfdk	https://tomcat.apache.org/security-3.html	38.0.0
2026-04-01T12:38:20.979063+00:00	Apache Tomcat Importer	Affected by	VCID-shq7-jxup-5fgk	https://tomcat.apache.org/security-3.html	38.0.0
2026-04-01T12:38:20.928784+00:00	Apache Tomcat Importer	Affected by	VCID-6yk2-f8d5-cyc3	https://tomcat.apache.org/security-3.html	38.0.0
2026-04-01T12:38:20.877136+00:00	Apache Tomcat Importer	Affected by	VCID-6ss8-442a-3baf	https://tomcat.apache.org/security-3.html	38.0.0
2026-04-01T12:38:20.760131+00:00	Apache Tomcat Importer	Affected by	VCID-x6zh-jypa-pbcc	https://tomcat.apache.org/security-3.html	38.0.0