VulnerableCode Package Details - pkg:rpm/redhat/tomcat5@5.5.23-0jpp

Search for packages

Vulnerability	Summary	Fixed by
VCID-2jnv-segx-zkfd Aliases: CVE-2006-3835 GHSA-wfj7-mhr5-pcwq	Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.	There are no reported fixed by versions.
VCID-6epr-2hbd-skcz Aliases: CVE-2005-2090 GHSA-f2gq-p6qv-ccw4	Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."	There are no reported fixed by versions.
VCID-86ur-vudp-4yc2 Aliases: CVE-2007-1858	The default SSL cipher configuration in Apache Tomcat 4.1.28 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.17 uses certain insecure ciphers, including the anonymous cipher, which allows remote attackers to obtain sensitive information or have other, unspecified impacts.	There are no reported fixed by versions.
VCID-87p8-zvvf-y7dm Aliases: CVE-2007-0450 GHSA-4prh-gqw8-rgh5	Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.	There are no reported fixed by versions.
VCID-bhq7-d545-27bj Aliases: CVE-2006-7196 GHSA-pm78-wxxf-fw98	Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors. NOTE: this may be related to CVE-2006-0254.1.	There are no reported fixed by versions.
VCID-qxkf-4ddv-j3b7 Aliases: CVE-2007-1358 GHSA-xmc9-6p56-3c4v	Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".	There are no reported fixed by versions.
VCID-skar-qk57-qkdv Aliases: CVE-2006-7195 GHSA-p57v-p3fx-qgwm	Cross-site scripting (XSS) vulnerability in implicit-objects.jsp in Apache Tomcat 5.0.0 through 5.0.30 and 5.5.0 through 5.5.17 allows remote attackers to inject arbitrary web script or HTML via certain header values.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-2jnv-segx-zkfd
Aliases:
CVE-2006-3835
GHSA-wfj7-mhr5-pcwq

Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.