Search for packages
| purl | pkg:maven/org.apache.tomcat/tomcat@6.0.0 |
| Tags | Ghost |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 10.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2017-5647
|
Important: Information Disclosure | There are no reported fixed by versions. |
|
CVE-2016-8735
|
Important: Remote Code Execution | There are no reported fixed by versions. |
|
CVE-2016-6816
|
Important: Information Disclosure | There are no reported fixed by versions. |
|
CVE-2016-6797
|
Low: Unrestricted Access to Global Resources | There are no reported fixed by versions. |
|
CVE-2016-6796
|
Low: Security Manager Bypass | There are no reported fixed by versions. |
|
CVE-2016-6794
|
Low: System Property Disclosure | There are no reported fixed by versions. |
|
CVE-2016-5018
|
Low: Security Manager Bypass | There are no reported fixed by versions. |
|
CVE-2016-0762
|
Low: Timing Attack | There are no reported fixed by versions. |
|
CVE-2015-5174
|
Low: Limited directory traversal | There are no reported fixed by versions. |
|
CVE-2015-5345
|
Low: Directory disclosure | There are no reported fixed by versions. |
|
CVE-2016-0706
|
Low: Security Manager bypass | There are no reported fixed by versions. |
|
CVE-2016-0714
|
Moderate: Security Manager bypass | There are no reported fixed by versions. |
|
CVE-2014-0230
|
Low: Denial of Service | There are no reported fixed by versions. |
|
CVE-2014-7810
|
Moderate: Security Manager bypass | There are no reported fixed by versions. |
|
CVE-2014-0227
|
Important: Request Smuggling | There are no reported fixed by versions. |
|
CVE-2014-0075
|
Important: Denial of Service | There are no reported fixed by versions. |
|
CVE-2014-0096
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2014-0099
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2014-0119
|
Low: Information Disclosure | There are no reported fixed by versions. |
|
CVE-2013-1571
|
Low: Frame injection in documentation Javadoc | There are no reported fixed by versions. |
|
CVE-2013-4286
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2013-4322
|
Important: Denial of service | There are no reported fixed by versions. |
|
CVE-2013-4590
|
Low: Information disclosure | There are no reported fixed by versions. |
|
CVE-2012-3544
|
Important: Denial of service | There are no reported fixed by versions. |
|
CVE-2012-2733
|
Important: Denial of service | There are no reported fixed by versions. |
|
CVE-2012-3439
|
Moderate: DIGEST authentication weakness | There are no reported fixed by versions. |
|
CVE-2012-3546
|
Important: Bypass of security constraints | There are no reported fixed by versions. |
|
CVE-2012-4534
|
Important: Denial of service | There are no reported fixed by versions. |
|
CVE-2011-3190
|
Important: Authentication bypass and information disclosure | There are no reported fixed by versions. |
|
CVE-2012-0022
|
Important: Denial of service | There are no reported fixed by versions. |
|
CVE-2011-1184
|
Moderate: Multiple weaknesses in HTTP DIGEST authentication | There are no reported fixed by versions. |
|
CVE-2011-2204
|
Low: Information disclosure | There are no reported fixed by versions. |
|
CVE-2011-2526
|
Low: Information disclosure | There are no reported fixed by versions. |
|
CVE-2011-0534
|
Important: Remote Denial Of Service | There are no reported fixed by versions. |
|
CVE-2011-0013
|
Low: Cross-site scripting | There are no reported fixed by versions. |
|
CVE-2010-3718
|
Low: SecurityManager file permission bypass | There are no reported fixed by versions. |
|
CVE-2010-2227
|
Important: Remote Denial Of Service and Information Disclosure Vulnerability | There are no reported fixed by versions. |
|
CVE-2010-1157
|
Low: Information disclosure in authentication headers | There are no reported fixed by versions. |
|
CVE-2009-2693
|
Low: Arbitrary file deletion and/or alteration on deploy | There are no reported fixed by versions. |
|
CVE-2009-2901
|
Low: Insecure partial deploy after failed undeploy | There are no reported fixed by versions. |
|
CVE-2009-2902
|
Low: Unexpected file deletion in work directory | There are no reported fixed by versions. |
|
CVE-2009-3548
|
Low: Insecure default password | There are no reported fixed by versions. |
|
CVE-2008-5515
|
Important: Information Disclosure | There are no reported fixed by versions. |
|
CVE-2009-0033
|
Important: Denial of Service | There are no reported fixed by versions. |
|
CVE-2009-0580
|
Low: Information disclosure | There are no reported fixed by versions. |
|
CVE-2009-0781
|
Low: Cross-site scripting | There are no reported fixed by versions. |
|
CVE-2009-0783
|
Low: Information disclosure | There are no reported fixed by versions. |
|
CVE-2008-1232
|
Low: Cross-site scripting | There are no reported fixed by versions. |
|
CVE-2008-1947
|
Low: Cross-site scripting | There are no reported fixed by versions. |
|
CVE-2008-2370
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2007-5333
|
Low: Session hi-jacking | There are no reported fixed by versions. |
|
CVE-2007-5342
|
Low: Elevated privileges | There are no reported fixed by versions. |
|
CVE-2007-5461
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2007-6286
|
Important: Data integrity | There are no reported fixed by versions. |
|
CVE-2007-2449
|
Low: Cross-site scripting | There are no reported fixed by versions. |
|
CVE-2007-2450
|
Low: Cross-site scripting | There are no reported fixed by versions. |
|
CVE-2007-3382
|
Low: Session hi-jacking | There are no reported fixed by versions. |
|
CVE-2007-3385
|
Low: Session hi-jacking | There are no reported fixed by versions. |
|
CVE-2007-3386
|
Low: Cross-site scripting | There are no reported fixed by versions. |
|
CVE-2007-1355
|
Moderate: Cross-site scripting | There are no reported fixed by versions. |
|
CVE-2005-2090
|
Important: Information disclosure | There are no reported fixed by versions. |
|
CVE-2007-0450
|
Important: Directory traversal | There are no reported fixed by versions. |
|
CVE-2008-0128
|
Moderate: Session hi-jacking | There are no reported fixed by versions. |
|
CVE-2007-1358
|
Low: Cross-site scripting | There are no reported fixed by versions. |
|
GHSA-9ggm-7897-x4mg
Aliases: CVE-2011-2526 |
Improper Input Validation in Apache Tomcat Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.19, when sendfile … | There are no reported fixed by versions. |
|
GHSA-hffm-fqv4-w27r
Aliases: CVE-2011-5063 |
Improper Authentication in Apache Tomcat The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, … | There are no reported fixed by versions. |
|
GHSA-99rf-92v6-cwx4
Aliases: CVE-2012-5885 |
Improper Access Control in Apache Tomcat The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x … | There are no reported fixed by versions. |
|
GHSA-3p86-xgrq-m6p6
Aliases: CVE-2011-0013 |
Improper Neutralization of Input During Web Page Generation in Apache Tomcat Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager … | There are no reported fixed by versions. |
|
GHSA-qrj4-rmqg-4hcp
Aliases: CVE-2007-6286 |
Apache Tomcat Does Not Properly Handle Empty Requests Apache Tomcat 5.5.11 through 5.5.25 and 6.0.0 through 6.0.15, when the native … | There are no reported fixed by versions. |
|
GHSA-5cw4-ggx9-36vg
Aliases: CVE-2009-0033 |
Apache Tomcat Denial of Service via Malformed Request Headers Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through … | There are no reported fixed by versions. |
|
GHSA-jgm2-m5cg-f66g
Aliases: CVE-2012-3546 |
Authentication Bypass in Apache Tomcat org/apache/catalina/realm/RealmBase.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.30, when FORM authentication is … | There are no reported fixed by versions. |
|
GHSA-f7w7-6pjc-wwm6
Aliases: CVE-2009-3555 |
Apache Tomcat affected by vulnerability in TLS and SSL protocol The TLS protocol, and the SSL protocol 3.0 and possibly … | There are no reported fixed by versions. |
|
GHSA-fj6c-prgj-gr3r
Aliases: CVE-2010-3718 |
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, … | There are no reported fixed by versions. |
|
GHSA-gvgc-rxmh-5hvw
Aliases: CVE-2010-4476 |
Apache Tomcat affected by infinite loop in Double.parseDouble method in Java Runtime Environment The `Double.parseDouble` method in Java Runtime Environment … | There are no reported fixed by versions. |
|
GHSA-wr3m-gw98-mc3j
Aliases: CVE-2011-4858 |
Improper Input Validation in Apache Tomcat Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values … | There are no reported fixed by versions. |
|
GHSA-qff8-g48j-pwpw
Aliases: CVE-2007-3382 |
Apache Tomcat treats single quotes as delimiters in cookies Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, … | There are no reported fixed by versions. |
|
GHSA-c57p-3v2g-w9rg
Aliases: CVE-2011-2204 |
Insertion of Sensitive Information into Log File in Apache Tomcat Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x … | There are no reported fixed by versions. |
|
GHSA-42j3-498q-m6vp
Aliases: CVE-2014-0227 |
Improper Input Validation in Apache Tomcat `java/org/apache/coyote/http11/filters/ChunkedInputFilter.java` in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 … | There are no reported fixed by versions. |
|
GHSA-qfxv-3ppc-7qg5
Aliases: CVE-2012-3544 |
Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions Apache Tomcat 6.x before 6.0.37 and … | There are no reported fixed by versions. |
|
GHSA-28cq-6rmx-pjq4
Aliases: CVE-2012-5887 |
Improper Authentication in Apache Tomcat The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, … | There are no reported fixed by versions. |
|
GHSA-hc39-rjwp-qffq
Aliases: CVE-2007-2449 |
Apache Tomcat XSS Vulnerabilities in Examples Web Application Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples … | There are no reported fixed by versions. |
|
GHSA-5x5f-9r6q-q7mh
Aliases: CVE-2008-0002 |
Apache Tomcat Sensitive Information Disclosure Apache Tomcat 6.0.0 through 6.0.15 processes parameters in the context of the wrong request when … | There are no reported fixed by versions. |
|
GHSA-9737-qmgc-hfr9
Aliases: CVE-2008-5515 |
Directory Traversal in Apache Tomcat Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions … | There are no reported fixed by versions. |
|
GHSA-6j8f-66vh-39mj
Aliases: CVE-2007-3385 |
Apache Tomcat Mishandles Character Sequence in Cookies Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to … | There are no reported fixed by versions. |
|
GHSA-pvjh-7h8q-q56r
Aliases: CVE-2010-4312 |
Apache Tomcat has cookies without HTTPOnly flag in Set-Cookie header The default configuration of Apache Tomcat 6.x does not include … | There are no reported fixed by versions. |
|
GHSA-w227-xcfx-3pj8
Aliases: CVE-2009-0580 |
Exposure of Sensitive Information in Apache Tomcat Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when … | There are no reported fixed by versions. |
|
GHSA-q9xf-jwr4-v445
Aliases: CVE-2011-1184 |
Authentication Bypass in Apache Tomcat The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, … | There are no reported fixed by versions. |
|
GHSA-v5p2-vg3c-pmrr
Aliases: CVE-2007-5461 |
Apache Tomcat Path Traversal Vulnerability Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, … | There are no reported fixed by versions. |
|
GHSA-76vr-72mv-mf3q
Aliases: CVE-2012-4431 |
Cross-Site Request Forgery in Apache Tomcat org/apache/catalina/filters/CsrfPreventionFilter.java in Apache Tomcat 6.x before 6.0.36 and 7.x before 7.0.32 allows remote attackers … | There are no reported fixed by versions. |
|
GHSA-6cr4-7c7p-p3xv
Aliases: CVE-2011-5064 |
Use of Hard-coded Cryptographic Key in Apache Tomcat DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x … | There are no reported fixed by versions. |
|
GHSA-cxg2-49rq-8gcr
Aliases: CVE-2010-2227 |
Apache Tomcat does not properly handle an invalid Transfer-Encoding header Apache Tomcat 5.5.0 through 5.5.29, 6.0.0 through 6.0.27, and 7.0.0 … | There are no reported fixed by versions. |
|
GHSA-4f7h-9j2x-cmr4
Aliases: CVE-2011-5062 |
Improper Authentication in Apache Tomcat The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, … | There are no reported fixed by versions. |
|
GHSA-8h2q-qm9x-55jc
Aliases: CVE-2012-0022 |
Denial of Service in Apache Tomcat Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an … | There are no reported fixed by versions. |
|
GHSA-4c43-cwvx-9crh
Aliases: CVE-2014-7810 |
Improper Access Control in Apache Tomcat The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, … | There are no reported fixed by versions. |
|
GHSA-pxcx-cxq8-4mmw
Aliases: CVE-2014-0230 |
Uncontrolled Resource Consumption in Apache Tomcat Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not … | There are no reported fixed by versions. |
|
CVE-2009-0783
Aliases: GHSA-hhjg-g8xq-hhr3 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and … | There are no reported fixed by versions. |
|
CVE-2012-5886
Aliases: GHSA-9xrj-439h-62hg |
Improper Authentication The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before … | There are no reported fixed by versions. |
|
GHSA-mv42-px54-87jw
Aliases: CVE-2016-0714 |
Improper Access Control in Apache Tomcat The session-persistence implementation in Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before … | There are no reported fixed by versions. |
|
GHSA-rh8q-vjgf-gf74
Aliases: CVE-2015-5345 |
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat The Mapper component in Apache Tomcat 6.x before … | There are no reported fixed by versions. |
|
CVE-2010-3718
Aliases: GHSA-fj6c-prgj-gr3r |
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, … | There are no reported fixed by versions. |
|
CVE-2009-2693
Aliases: GHSA-ggx9-4728-588r |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 … | There are no reported fixed by versions. |
|
CVE-2017-5647
Aliases: GHSA-3gv7-3h64-78cm |
Exposure of Sensitive Information to an Unauthorized Actor A bug in the handling of the pipelined requests in Apache Tomcat … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2009-2901
Aliases: GHSA-hjfh-7c4v-7q8h |
Improper Authentication in Apache Tomcat The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy … | There are no reported fixed by versions. |
|
CVE-2008-1947
Aliases: GHSA-f98p-9pp6-7q6c |
Apache Tomcat Cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 … | There are no reported fixed by versions. |
|
GHSA-f98p-9pp6-7q6c
Aliases: CVE-2008-1947 |
Apache Tomcat Cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in Apache Tomcat 5.5.9 through 5.5.26 and 6.0.0 through 6.0.16 … | There are no reported fixed by versions. |
|
GHSA-hjfh-7c4v-7q8h
Aliases: CVE-2009-2901 |
Improper Authentication in Apache Tomcat The autodeployment process in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20, when autoDeploy … | There are no reported fixed by versions. |
|
GHSA-ggx9-4728-588r
Aliases: CVE-2009-2693 |
Apache Tomcat Directory Traversal vulnerability Directory traversal vulnerability in Apache Tomcat 5.5.0 through 5.5.28 and 6.0.0 through 6.0.20 allows remote … | There are no reported fixed by versions. |
|
GHSA-j788-fx57-99wp
Aliases: CVE-2009-0781 |
Cross-site scripting in Apache Tomcat Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application … | There are no reported fixed by versions. |
|
GHSA-3gv7-3h64-78cm
Aliases: CVE-2017-5647 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat A bug in the handling of the pipelined requests … | There are no reported fixed by versions. |
|
GHSA-hhjg-g8xq-hhr3
Aliases: CVE-2009-0783 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and … | There are no reported fixed by versions. |
|
GHSA-q74x-qqhr-f8rx
Aliases: CVE-2008-1232 |
Apache Tomcat Cross-site scripting (XSS) vulnerability Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and … | There are no reported fixed by versions. |
|
GHSA-5c5p-jxvx-x7j2
Aliases: CVE-2007-2450 |
Apache Tomcat vulnerable to Cross-site Scripting Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web … | There are no reported fixed by versions. |
|
GHSA-wxcp-f2c8-x6xv
Aliases: CVE-2016-0762 |
Observable Discrepancy in Apache Tomcat The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to … | There are no reported fixed by versions. |
|
GHSA-3mjp-p938-4329
Aliases: CVE-2016-6796 |
Apache Tomcat vulnerable to SecurityManager bypass A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, … | There are no reported fixed by versions. |
|
GHSA-6vx3-hr43-cfrh
Aliases: CVE-2016-0706 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x … | There are no reported fixed by versions. |
|
GHSA-m7xj-ccqc-p4g2
Aliases: CVE-2008-2938 |
Apache Tomcat Directory Traversal vulnerability Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through … | There are no reported fixed by versions. |
|
GHSA-c38m-v4m2-524v
Aliases: CVE-2011-3190 |
Apache Tomcat Allows Remote Attackers to Spoof AJP Requests Certain AJP protocol connector implementations in Apache Tomcat 7.0.0 through 7.0.20, … | There are no reported fixed by versions. |
|
GHSA-cww4-vj5r-rx57
Aliases: CVE-2007-5333 |
Exposure of Sensitive Information in Apache Tomcat Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does … | There are no reported fixed by versions. |
|
GHSA-6qr6-x7jm-x2q6
Aliases: CVE-2015-5174 |
Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat Directory traversal vulnerability in RequestUtil.java in Apache Tomcat … | There are no reported fixed by versions. |
|
GHSA-8wch-9gcg-v2pr
Aliases: CVE-2009-2902 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat Directory traversal vulnerability in Apache Tomcat … | There are no reported fixed by versions. |
|
GHSA-43v2-6grp-9pp9
Aliases: CVE-2011-0534 |
Apache Tomcat does not enforce the maxHttpHeaderSize limit Apache Tomcat 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 does not enforce … | There are no reported fixed by versions. |
|
GHSA-w6q7-ww2x-7gm3
Aliases: CVE-2010-1157 |
Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 … | There are no reported fixed by versions. |
|
GHSA-2rvf-329f-p99g
Aliases: CVE-2016-6794 |
System Property Disclosure in Apache Tomcat When a SecurityManager is configured, a web application's ability to read system properties should … | There are no reported fixed by versions. |
|
GHSA-m8h8-6rvg-f4mg
Aliases: CVE-2008-2370 |
Apache Tomcat Path Traversal Vulnerability Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a `RequestDispatcher` … | There are no reported fixed by versions. |