{"url":"http://public2.vulnerablecode.io/api/packages/61735?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@4.1.32","type":"maven","namespace":"org.apache.tomcat","name":"tomcat","version":"4.1.32","qualifiers":{},"subpath":"","is_vulnerable":true,"next_non_vulnerable_version":"4.1.35","latest_non_vulnerable_version":"11.0.18","affected_by_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43188?format=json","vulnerability_id":"VCID-4wj8-en12-uuch","summary":"Exposure of Sensitive Information to an Unauthorized Actor\nThe doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.","references":[{"reference_url":"http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000010.html","reference_id":"","reference_type":"","scores":[],"url":"http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-000010.html"},{"reference_url":"http://jvn.jp/en/jp/JVN66905322/index.html","reference_id":"","reference_type":"","scores":[],"url":"http://jvn.jp/en/jp/JVN66905322/index.html"},{"reference_url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=40771","reference_id":"","reference_type":"","scores":[],"url":"https://issues.apache.org/bugzilla/show_bug.cgi?id=40771"},{"reference_url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://web.archive.org/web/20090228052951/http://secunia.com/advisories/34057","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20090228052951/http://secunia.com/advisories/34057"},{"reference_url":"https://web.archive.org/web/20111229174634/http://www.securityfocus.com/archive/1/501250","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20111229174634/http://www.securityfocus.com/archive/1/501250"},{"reference_url":"https://web.archive.org/web/20201207165808/http://www.securityfocus.com/bid/33913","reference_id":"","reference_type":"","scores":[],"url":"https://web.archive.org/web/20201207165808/http://www.securityfocus.com/bid/33913"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4308","reference_id":"CVE-2008-4308","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2008-4308"},{"reference_url":"https://github.com/advisories/GHSA-7g59-hm8v-cwmc","reference_id":"GHSA-7g59-hm8v-cwmc","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-7g59-hm8v-cwmc"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61824?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@4.1.35","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@4.1.35"},{"url":"http://public2.vulnerablecode.io/api/packages/61825?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.5.21","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.5.21"}],"aliases":["CVE-2008-4308","GHSA-7g59-hm8v-cwmc"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-4wj8-en12-uuch"}],"fixing_vulnerabilities":[{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/43131?format=json","vulnerability_id":"VCID-2af1-rv9j-jugv","summary":"Cross-site scripting in Apache Tomcat\nCross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.","references":[{"reference_url":"https://access.redhat.com/errata/RHSA-2007:0326","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2007:0326"},{"reference_url":"https://access.redhat.com/errata/RHSA-2007:0340","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2007:0340"},{"reference_url":"https://access.redhat.com/errata/RHSA-2008:0261","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2008:0261"},{"reference_url":"https://access.redhat.com/errata/RHSA-2008:0524","reference_id":"","reference_type":"","scores":[],"url":"https://access.redhat.com/errata/RHSA-2008:0524"},{"reference_url":"https://bugzilla.redhat.com/show_bug.cgi?id=238131","reference_id":"","reference_type":"","scores":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=238131"},{"reference_url":"https://github.com/apache/tomcat","reference_id":"","reference_type":"","scores":[],"url":"https://github.com/apache/tomcat"},{"reference_url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E","reference_id":"","reference_type":"","scores":[],"url":"https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"},{"reference_url":"https://access.redhat.com/security/cve/CVE-2006-7196","reference_id":"CVE-2006-7196","reference_type":"","scores":[],"url":"https://access.redhat.com/security/cve/CVE-2006-7196"},{"reference_url":"https://nvd.nist.gov/vuln/detail/CVE-2006-7196","reference_id":"CVE-2006-7196","reference_type":"","scores":[],"url":"https://nvd.nist.gov/vuln/detail/CVE-2006-7196"},{"reference_url":"https://github.com/advisories/GHSA-pm78-wxxf-fw98","reference_id":"GHSA-pm78-wxxf-fw98","reference_type":"","scores":[],"url":"https://github.com/advisories/GHSA-pm78-wxxf-fw98"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/61734?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@4.0.7","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@4.0.7"},{"url":"http://public2.vulnerablecode.io/api/packages/61735?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@4.1.32","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-4wj8-en12-uuch"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@4.1.32"},{"url":"http://public2.vulnerablecode.io/api/packages/61736?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.0.31","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.0.31"},{"url":"http://public2.vulnerablecode.io/api/packages/61737?format=json","purl":"pkg:maven/org.apache.tomcat/tomcat@5.5.16","is_vulnerable":false,"affected_by_vulnerabilities":[],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@5.5.16"}],"aliases":["CVE-2006-7196","GHSA-pm78-wxxf-fw98"],"risk_score":null,"exploitability":null,"weighted_severity":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-2af1-rv9j-jugv"}],"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.tomcat/tomcat@4.1.32"}