Search for packages
| purl | pkg:apache/tomcat@6.0.20 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1qt3-ctae-sfgw
Aliases: CVE-2009-2693 GHSA-ggx9-4728-588r |
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry. |
Affected by 0 other vulnerabilities. |
|
VCID-g998-xymt-fudu
Aliases: CVE-2009-2901 GHSA-hjfh-7c4v-7q8h |
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests. |
Affected by 0 other vulnerabilities. |
|
VCID-vm4b-26sq-tfev
Aliases: CVE-2009-3548 |
The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges. |
Affected by 0 other vulnerabilities. |
|
VCID-wsn2-pd9b-b3g8
Aliases: CVE-2009-2902 GHSA-8wch-9gcg-v2pr |
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename. |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4rcx-xfn5-7kdb | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter. |
CVE-2009-0580
GHSA-w227-xcfx-3pj8 |
| VCID-bung-pa58-ayfv | Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." |
CVE-2009-0781
GHSA-j788-fx57-99wp |
| VCID-dcrp-rae1-zfcm | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. |
CVE-2009-0033
GHSA-5cw4-ggx9-36vg |
| VCID-mnf8-t3ew-4fgb | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request. |
CVE-2008-5515
GHSA-9737-qmgc-hfr9 |
| VCID-r84b-7ay9-ekcm | Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application. |
CVE-2009-0783
GHSA-hhjg-g8xq-hhr3 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T12:38:17.557665+00:00 | Apache Tomcat Importer | Fixing | VCID-r84b-7ay9-ekcm | https://tomcat.apache.org/security-6.html | 38.0.0 |
| 2026-04-01T12:38:17.525847+00:00 | Apache Tomcat Importer | Fixing | VCID-bung-pa58-ayfv | https://tomcat.apache.org/security-6.html | 38.0.0 |
| 2026-04-01T12:38:17.494139+00:00 | Apache Tomcat Importer | Fixing | VCID-4rcx-xfn5-7kdb | https://tomcat.apache.org/security-6.html | 38.0.0 |
| 2026-04-01T12:38:17.462216+00:00 | Apache Tomcat Importer | Fixing | VCID-dcrp-rae1-zfcm | https://tomcat.apache.org/security-6.html | 38.0.0 |
| 2026-04-01T12:38:17.430551+00:00 | Apache Tomcat Importer | Fixing | VCID-mnf8-t3ew-4fgb | https://tomcat.apache.org/security-6.html | 38.0.0 |
| 2026-04-01T12:38:17.396357+00:00 | Apache Tomcat Importer | Affected by | VCID-vm4b-26sq-tfev | https://tomcat.apache.org/security-6.html | 38.0.0 |
| 2026-04-01T12:38:17.368576+00:00 | Apache Tomcat Importer | Affected by | VCID-wsn2-pd9b-b3g8 | https://tomcat.apache.org/security-6.html | 38.0.0 |
| 2026-04-01T12:38:17.341408+00:00 | Apache Tomcat Importer | Affected by | VCID-g998-xymt-fudu | https://tomcat.apache.org/security-6.html | 38.0.0 |
| 2026-04-01T12:38:17.310941+00:00 | Apache Tomcat Importer | Affected by | VCID-1qt3-ctae-sfgw | https://tomcat.apache.org/security-6.html | 38.0.0 |