Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@5.5.15
purl pkg:maven/org.apache.tomcat/tomcat@5.5.15
Tags Ghost
Next non-vulnerable version 9.0.117
Latest non-vulnerable version 11.0.21
Risk 10.0
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-bhq7-d545-27bj
Aliases:
CVE-2006-7196
GHSA-pm78-wxxf-fw98
Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.
5.5.16
Affected by 1 other vulnerability.
5.5.16,
Affected by 0 other vulnerabilities.
VCID-jt5d-3ema-nkdh
Aliases:
CVE-2006-7197
GHSA-jpqr-vh55-xqxf
Apache Tomcat Buffer Over-Read The AJP connector in Apache Tomcat 5.5.15 uses an incorrect length for chunks, which can cause a buffer over-read in the `ajp_process_callback` in mod_jk, which allows remote attackers to read portions of sensitive memory. There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T16:00:28.648544+00:00 GHSA Importer Affected by VCID-jt5d-3ema-nkdh https://github.com/advisories/GHSA-jpqr-vh55-xqxf 38.0.0
2026-04-01T12:49:55.876568+00:00 GitLab Importer Affected by VCID-jt5d-3ema-nkdh https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2006-7197.yml 38.0.0
2026-04-01T12:38:19.362792+00:00 Apache Tomcat Importer Affected by VCID-bhq7-d545-27bj https://tomcat.apache.org/security-5.html 38.0.0