Search for packages
Package details: pkg:apache/tomcat@7.0.97
purl pkg:apache/tomcat@7.0.97
Next non-vulnerable version 8.0.0-RC10
Latest non-vulnerable version 11.0.8
Risk 10.0
Vulnerabilities affecting this package (11)
Vulnerability Summary Fixed by
VCID-259r-tjud-aaad
Aliases:
CVE-2020-1935
GHSA-qxf4-chvg-4r8r
Potential HTTP request smuggling in Apache Tomcat
7.0.100
Affected by 7 other vulnerabilities.
8.5.51
Affected by 25 other vulnerabilities.
9.0.31
Affected by 24 other vulnerabilities.
VCID-2xpy-bz6f-aaak
Aliases:
CVE-2020-1938
GHSA-c9hw-wf7x-jp9j
Improper Privilege Management in Tomcat
7.0.100
Affected by 7 other vulnerabilities.
8.5.51
Affected by 25 other vulnerabilities.
9.0.31
Affected by 24 other vulnerabilities.
VCID-6zmg-trun-aaac
Aliases:
CVE-2021-30640
GHSA-36qh-35cm-5w2w
Authentication Bypass by Alternate Name in Apache Tomcat
7.0.109
Affected by 2 other vulnerabilities.
8.5.66
Affected by 16 other vulnerabilities.
9.0.46
Affected by 16 other vulnerabilities.
10.0.6
Affected by 9 other vulnerabilities.
VCID-8qf1-1syh-aaap
Aliases:
CVE-2019-12418
GHSA-hh3j-x4mc-g48r
Insufficiently Protected Credentials in Apache Tomcat
7.0.98
Affected by 11 other vulnerabilities.
7.0.99
Affected by 10 other vulnerabilities.
8.5.48
Affected by 28 other vulnerabilities.
8.5.49
Affected by 28 other vulnerabilities.
9.0.29
Affected by 27 other vulnerabilities.
VCID-ah95-hj74-aaaq
Aliases:
CVE-2017-12617
GHSA-xjgh-84hx-56c5
Unrestricted Upload of File with Dangerous Type When running Apache Tomcat with HTTP PUTs enabled it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
8.0.47
Affected by 1 other vulnerability.
8.5.23
Affected by 38 other vulnerabilities.
9.0.1
Affected by 38 other vulnerabilities.
VCID-akem-ybu8-aaab
Aliases:
CVE-2021-25329
GHSA-jgwr-3qm3-26f3
Potential remote code execution in Apache Tomcat
7.0.108
Affected by 3 other vulnerabilities.
8.5.62
Affected by 18 other vulnerabilities.
8.5.63
Affected by 19 other vulnerabilities.
9.0.42
Affected by 18 other vulnerabilities.
9.0.43
Affected by 19 other vulnerabilities.
10.0.0.0-M1
Affected by 11 other vulnerabilities.
10.0.2
Affected by 11 other vulnerabilities.
VCID-jqdk-mw8x-aaae
Aliases:
CVE-2019-17563
GHSA-9xcj-c8cr-8c3c
In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack
7.0.99
Affected by 10 other vulnerabilities.
8.5.50
Affected by 28 other vulnerabilities.
9.0.30
Affected by 27 other vulnerabilities.
VCID-ma76-864y-aaaf
Aliases:
CVE-2005-4836
GHSA-qrcx-p4rr-g48h
The HTTP/1.1 connector in Apache Tomcat 4.1.15 through 4.1.40 does not reject NULL bytes in a URL when allowLinking is configured, which allows remote attackers to read JSP source files and obtain sensitive information. There are no reported fixed by versions.
VCID-nj2d-yt1t-aaaj
Aliases:
CVE-2020-13935
GHSA-m7jv-hq7h-mq7c
Infinite Loop in Apache Tomcat
7.0.105
Affected by 6 other vulnerabilities.
8.5.57
Affected by 23 other vulnerabilities.
9.0.37
Affected by 22 other vulnerabilities.
10.0.0-M7
Affected by 17 other vulnerabilities.
VCID-nm9b-h95h-aaaa
Aliases:
CVE-2020-9484
GHSA-344f-f5vg-2jfj
Potential remote code execution in Apache Tomcat
7.0.104
Affected by 7 other vulnerabilities.
7.0.108
Affected by 3 other vulnerabilities.
8.5.55
Affected by 25 other vulnerabilities.
8.5.62
Affected by 18 other vulnerabilities.
8.5.63
Affected by 19 other vulnerabilities.
9.0.35
Affected by 24 other vulnerabilities.
9.0.42
Affected by 18 other vulnerabilities.
9.0.43
Affected by 19 other vulnerabilities.
10.0.0-M5
Affected by 20 other vulnerabilities.
10.0.0.0-M1
Affected by 11 other vulnerabilities.
10.0.2
Affected by 11 other vulnerabilities.
VCID-w4d3-t13k-aaab
Aliases:
CVE-2021-24122
GHSA-2rvv-w9r2-rg7m
Information Disclosure in Apache Tomcat
7.0.107
Affected by 5 other vulnerabilities.
8.5.60
Affected by 21 other vulnerabilities.
9.0.40
Affected by 21 other vulnerabilities.
10.0.0-M10
Affected by 17 other vulnerabilities.
10.0.0
Affected by 14 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2025-03-28T13:19:28.246836+00:00 Apache Tomcat Importer Affected by VCID-8qf1-1syh-aaap https://tomcat.apache.org/security-7.html 36.0.0
2024-09-18T08:17:38.404754+00:00 Apache Tomcat Importer Affected by VCID-8qf1-1syh-aaap https://tomcat.apache.org/security-7.html 34.0.1
2024-01-04T02:15:41.756220+00:00 Apache Tomcat Importer Affected by VCID-8qf1-1syh-aaap https://tomcat.apache.org/security-7.html 34.0.0rc1