Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:apache/tomcat@6.0.5
purl pkg:apache/tomcat@6.0.5
Next non-vulnerable version 6.0.6
Latest non-vulnerable version 11.0.21
Risk 4.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-qxkf-4ddv-j3b7
Aliases:
CVE-2007-1358
GHSA-xmc9-6p56-3c4v
Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
6.0.6
Affected by 0 other vulnerabilities.
VCID-t9y6-suc2-2kcg
Aliases:
CVE-2008-0002
GHSA-5x5f-9r6q-q7mh
Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when an exception occurs during parameter processing, which might allow remote attackers to obtain sensitive information, as demonstrated by disconnecting during this processing in order to trigger the exception.
6.0.16
Affected by 4 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T12:38:18.089314+00:00 Apache Tomcat Importer Affected by VCID-qxkf-4ddv-j3b7 https://tomcat.apache.org/security-6.html 38.0.0
2026-04-01T12:38:17.795330+00:00 Apache Tomcat Importer Affected by VCID-t9y6-suc2-2kcg https://tomcat.apache.org/security-6.html 38.0.0