Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.tomcat/tomcat@5.5.28
purl pkg:maven/org.apache.tomcat/tomcat@5.5.28
Tags Ghost
Next non-vulnerable version 9.0.117
Latest non-vulnerable version 11.0.21
Risk 5.4
Vulnerabilities affecting this package (4)
Vulnerability Summary Fixed by
VCID-1qt3-ctae-sfgw
Aliases:
CVE-2009-2693
GHSA-ggx9-4728-588r
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in an entry in a WAR file, as demonstrated by a ../../bin/catalina.bat entry.
5.5.29
Affected by 3 other vulnerabilities.
6.0.24
Affected by 0 other vulnerabilities.
VCID-g998-xymt-fudu
Aliases:
CVE-2009-2901
GHSA-hjfh-7c4v-7q8h
The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy is enabled, deploys appBase files that remain from a failed undeploy, which might allow remote attackers to bypass intended authentication requirements via HTTP requests.
5.5.29
Affected by 3 other vulnerabilities.
6.0.24
Affected by 0 other vulnerabilities.
VCID-vm4b-26sq-tfev
Aliases:
CVE-2009-3548
The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
5.5.29
Affected by 3 other vulnerabilities.
6.0.24
Affected by 0 other vulnerabilities.
VCID-wsn2-pd9b-b3g8
Aliases:
CVE-2009-2902
GHSA-8wch-9gcg-v2pr
Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote attackers to delete work-directory files via directory traversal sequences in a WAR filename, as demonstrated by the ...war filename.
5.5.29
Affected by 3 other vulnerabilities.
6.0.24
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-04T14:30:29.724745+00:00 GHSA Importer Fixing VCID-mnf8-t3ew-4fgb https://github.com/advisories/GHSA-9737-qmgc-hfr9 38.1.0
2026-04-01T16:00:38.285966+00:00 GHSA Importer Affected by VCID-wsn2-pd9b-b3g8 https://github.com/advisories/GHSA-8wch-9gcg-v2pr 38.0.0
2026-04-01T16:00:38.202629+00:00 GHSA Importer Affected by VCID-g998-xymt-fudu https://github.com/advisories/GHSA-hjfh-7c4v-7q8h 38.0.0
2026-04-01T16:00:37.899351+00:00 GHSA Importer Affected by VCID-1qt3-ctae-sfgw https://github.com/advisories/GHSA-ggx9-4728-588r 38.0.0
2026-04-01T16:00:36.669319+00:00 GHSA Importer Fixing VCID-4rcx-xfn5-7kdb https://github.com/advisories/GHSA-w227-xcfx-3pj8 38.0.0
2026-04-01T13:08:59.858092+00:00 GithubOSV Importer Fixing VCID-mnf8-t3ew-4fgb https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-9737-qmgc-hfr9/GHSA-9737-qmgc-hfr9.json 38.0.0
2026-04-01T13:08:52.570547+00:00 GithubOSV Importer Fixing VCID-4rcx-xfn5-7kdb https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w227-xcfx-3pj8/GHSA-w227-xcfx-3pj8.json 38.0.0
2026-04-01T12:50:32.010185+00:00 GitLab Importer Fixing VCID-mnf8-t3ew-4fgb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2008-5515.yml 38.0.0
2026-04-01T12:50:01.810658+00:00 GitLab Importer Affected by VCID-g998-xymt-fudu https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2009-2901.yml 38.0.0
2026-04-01T12:50:01.718237+00:00 GitLab Importer Affected by VCID-1qt3-ctae-sfgw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2009-2693.yml 38.0.0
2026-04-01T12:50:01.184559+00:00 GitLab Importer Fixing VCID-4rcx-xfn5-7kdb https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2009-0580.yml 38.0.0
2026-04-01T12:49:59.909906+00:00 GitLab Importer Affected by VCID-wsn2-pd9b-b3g8 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.tomcat/tomcat/CVE-2009-2902.yml 38.0.0
2026-04-01T12:38:18.672597+00:00 Apache Tomcat Importer Fixing VCID-r84b-7ay9-ekcm https://tomcat.apache.org/security-5.html 38.0.0
2026-04-01T12:38:18.641835+00:00 Apache Tomcat Importer Fixing VCID-bung-pa58-ayfv https://tomcat.apache.org/security-5.html 38.0.0
2026-04-01T12:38:18.613960+00:00 Apache Tomcat Importer Fixing VCID-4rcx-xfn5-7kdb https://tomcat.apache.org/security-5.html 38.0.0
2026-04-01T12:38:18.585523+00:00 Apache Tomcat Importer Fixing VCID-dcrp-rae1-zfcm https://tomcat.apache.org/security-5.html 38.0.0
2026-04-01T12:38:18.557564+00:00 Apache Tomcat Importer Fixing VCID-mnf8-t3ew-4fgb https://tomcat.apache.org/security-5.html 38.0.0
2026-04-01T12:38:18.523105+00:00 Apache Tomcat Importer Affected by VCID-vm4b-26sq-tfev https://tomcat.apache.org/security-5.html 38.0.0
2026-04-01T12:38:18.494585+00:00 Apache Tomcat Importer Affected by VCID-wsn2-pd9b-b3g8 https://tomcat.apache.org/security-5.html 38.0.0
2026-04-01T12:38:18.468059+00:00 Apache Tomcat Importer Affected by VCID-g998-xymt-fudu https://tomcat.apache.org/security-5.html 38.0.0
2026-04-01T12:38:18.439208+00:00 Apache Tomcat Importer Affected by VCID-1qt3-ctae-sfgw https://tomcat.apache.org/security-5.html 38.0.0