VulnerableCode Package Details - pkg:rpm/redhat/tomcat5@5.5.23-1.patch07.19.ep5?arch=el4

Search for packages

Vulnerability	Summary	Fixed by
VCID-4rcx-xfn5-7kdb Aliases: CVE-2009-0580 GHSA-w227-xcfx-3pj8	Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.	There are no reported fixed by versions.
VCID-dcrp-rae1-zfcm Aliases: CVE-2009-0033 GHSA-5cw4-ggx9-36vg	Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.	There are no reported fixed by versions.
VCID-mnf8-t3ew-4fgb Aliases: CVE-2008-5515 GHSA-9737-qmgc-hfr9	Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via .. (dot dot) sequences and the WEB-INF directory in a Request.	There are no reported fixed by versions.
VCID-r84b-7ay9-ekcm Aliases: CVE-2009-0783 GHSA-hhjg-g8xq-hhr3	Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web.xml, (2) context.xml, or (3) tld files of arbitrary web applications via a crafted application that is loaded earlier than the target application.	There are no reported fixed by versions.
VCID-v94p-bxm3-akfd Aliases: CVE-2007-5333 GHSA-cww4-vj5r-rx57	Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks. NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-4rcx-xfn5-7kdb
Aliases:
CVE-2009-0580
GHSA-w227-xcfx-3pj8

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.