Search for packages
| purl | pkg:apache/tomcat@7.0.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-886n-1vzv-syc6
Aliases: CVE-2010-4172 GHSA-c78g-qwpw-2jgv |
Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications. |
Affected by 2 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-tfn5-6ckq-wyce | Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack. |
CVE-2010-3718
GHSA-fj6c-prgj-gr3r |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T12:38:15.898649+00:00 | Apache Tomcat Importer | Fixing | VCID-tfn5-6ckq-wyce | https://tomcat.apache.org/security-7.html | 38.0.0 |
| 2026-04-01T12:38:15.864928+00:00 | Apache Tomcat Importer | Affected by | VCID-886n-1vzv-syc6 | https://tomcat.apache.org/security-7.html | 38.0.0 |