Dependency-Check Report

Dependency	Vulnerability IDs	Package	Highest Severity	CVE Count	Confidence	Evidence Count
checker-qual-3.49.2.jar		pkg:maven/org.checkerframework/checker-qual@3.49.2		0		44
error_prone_annotations-2.37.0.jar		pkg:maven/com.google.errorprone/error_prone_annotations@2.37.0		0		29
j2objc-annotations-3.0.0.jar		pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0		0		33
jsr305-3.0.2.jar		pkg:maven/com.google.code.findbugs/jsr305@3.0.2		0		17
lombok-1.18.38.jar: mavenEcjBootstrapAgent.jar				0		7
lombok-1.18.38.jar		pkg:maven/org.projectlombok/lombok@1.18.38		0		36
modernizer-maven-annotations-3.1.0.jar		pkg:maven/org.gaul/modernizer-maven-annotations@3.1.0		0		19
spotbugs-annotations-4.9.3.jar		pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.3		0		53
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: annotations-api.jar	cpe:2.3:a:apache:tomcat:9.0.104:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Low	30
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: bootstrap.jar	cpe:2.3:a:apache:tomcat:9.0.104:::::::*			0	Highest	16
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: catalina-ant.jar	cpe:2.3:a:apache:ant:9.0.104:::::::* cpe:2.3:a:apache:tomcat:9.0.104:::::::*			0	High	14
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: catalina-ha.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Highest	22
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: catalina.jar	cpe:2.3:a:apache:tomcat:9.0.104:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Highest	20
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: commons-daemon.jar	cpe:2.3:a:apache:apache_commons_daemon:1.4.1:::::::*	pkg:maven/commons-daemon/commons-daemon@1.4.1		0	Low	86
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: ecj-4.20.jar				0		25
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: el-api.jar	cpe:2.3:a:apache:tomcat:3.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*		CRITICAL*	31	Medium	20
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: jasper-el.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Low	26
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: jasper.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Highest	20
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: jaspic-api.jar	cpe:2.3:a:apache:tomcat:9.0.104:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Low	38
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: jsp-api.jar	cpe:2.3:a:apache:tomcat:9.0.104:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Low	39
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: sample.war				0		8
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: servlet-api.jar	cpe:2.3:a:apache:tomcat:4.0.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*		CRITICAL*	30	Medium	41
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: taglibs-standard-impl-1.2.5.jar	cpe:2.3:a:apache:standard_taglibs:1.2.5:::::::*	pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5		0	Highest	54
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-api.jar	cpe:2.3:a:apache:tomcat:9.0.104:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Highest	18
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-i18n-cs.jar	cpe:2.3:a:apache:tomcat:9.0.104:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Low	9
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-i18n-fr.jar	cpe:2.3:a:apache:tomcat:9.0.104:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::* cpe:2.3:a:nfr:nfr:9.0.104:::::::*			0	Low	9
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-juli.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:::::::*			0	Highest	18
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: websocket-api.jar				0		25

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: http://opensource.org/licenses/MIT

File Path: C:\Users\Jeremy\.m2\repository\org\checkerframework\checker-qual\3.49.2\checker-qual-3.49.2.jar
MD5: 41c09e58f686fc6d4e194aa37a1125b0
SHA1: 98ac669ccce59dba8ca360d3e07891d62b6b946a
SHA256:33b1d8b2c4b00f7d4f4b4931424274f3f729474ce3a87cea09a879976a1dcaeb
Referenced In Project/Scope: tomcat9-config:compile
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.104

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	checker-qual	High
Vendor	jar	package name	checker	Highest
Vendor	jar	package name	checkerframework	Highest
Vendor	jar	package name	framework	Highest
Vendor	jar	package name	qual	Highest
Vendor	Manifest	bundle-symbolicname	checker-qual	Medium
Vendor	Manifest	implementation-url	https://checkerframework.org	Low
Vendor	pom	artifactid	checker-qual	Highest
Vendor	pom	artifactid	checker-qual	Low
Vendor	pom	developer email	mernst@cs.washington.edu	Low
Vendor	pom	developer email	smillst@cs.washington.edu	Low
Vendor	pom	developer id	mernst	Medium
Vendor	pom	developer id	smillst	Medium
Vendor	pom	developer name	Michael Ernst	Medium
Vendor	pom	developer name	Suzanne Millstein	Medium
Vendor	pom	developer org	University of Washington	Medium
Vendor	pom	developer org URL	https://www.cs.washington.edu/	Medium
Vendor	pom	groupid	org.checkerframework	Highest
Vendor	pom	name	Checker Qual	High
Vendor	pom	url	https://checkerframework.org/	Highest
Product	file	name	checker-qual	High
Product	jar	package name	checker	Highest
Product	jar	package name	checkerframework	Highest
Product	jar	package name	framework	Highest
Product	jar	package name	qual	Highest
Product	Manifest	Bundle-Name	checker-qual	Medium
Product	Manifest	bundle-symbolicname	checker-qual	Medium
Product	Manifest	implementation-url	https://checkerframework.org	Low
Product	pom	artifactid	checker-qual	Highest
Product	pom	developer email	mernst@cs.washington.edu	Low
Product	pom	developer email	smillst@cs.washington.edu	Low
Product	pom	developer id	mernst	Low
Product	pom	developer id	smillst	Low
Product	pom	developer name	Michael Ernst	Low
Product	pom	developer name	Suzanne Millstein	Low
Product	pom	developer org	University of Washington	Low
Product	pom	developer org URL	https://www.cs.washington.edu/	Low
Product	pom	groupid	org.checkerframework	Highest
Product	pom	name	Checker Qual	High
Product	pom	url	https://checkerframework.org/	Medium
Version	file	version	3.49.2	High
Version	Manifest	Bundle-Version	3.49.2	High
Version	Manifest	Implementation-Version	3.49.2	High
Version	pom	version	3.49.2	Highest

Identifiers

pkg:maven/org.checkerframework/checker-qual@3.49.2 (Confidence:High)

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\errorprone\error_prone_annotations\2.37.0\error_prone_annotations-2.37.0.jar
MD5: dce0a1c83d3dc06c2715c96e11d2c429
SHA1: 8512660d1269d166fad497f51de35da61447f063
SHA256:d29a6263b48d46d4c7c28b64717a6d105b3e2a3e64256092f845e8e774fca6ba
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.104

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	error_prone_annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	errorprone	Highest
Vendor	jar	package name	google	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Vendor	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	error_prone_annotations	Highest
Vendor	pom	artifactid	error_prone_annotations	Low
Vendor	pom	groupid	com.google.errorprone	Highest
Vendor	pom	name	error-prone annotations	High
Vendor	pom	parent-artifactid	error_prone_parent	Low
Product	file	name	error_prone_annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	errorprone	Highest
Product	jar	package name	google	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Product	Manifest	Bundle-Name	error-prone annotations	Medium
Product	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	error_prone_annotations	Highest
Product	pom	groupid	com.google.errorprone	Highest
Product	pom	name	error-prone annotations	High
Product	pom	parent-artifactid	error_prone_parent	Medium
Version	file	version	2.37.0	High
Version	Manifest	Bundle-Version	2.37.0	High
Version	pom	version	2.37.0	Highest

Identifiers

pkg:maven/com.google.errorprone/error_prone_annotations@2.37.0 (Confidence:High)

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\j2objc\j2objc-annotations\3.0.0\j2objc-annotations-3.0.0.jar
MD5: f59529b29202a5baf37f491ea5ec8627
SHA1: 7399e65dd7e9ff3404f4535b2f017093bdb134c7
SHA256:88241573467ddca44ffd4d74aa04c2bbfd11bf7c17e0c342c94c9de7a70a7c64
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.104

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	j2objc-annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	google	Highest
Vendor	jar	package name	j2objc	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	j2objc-annotations	Highest
Vendor	pom	artifactid	j2objc-annotations	Low
Vendor	pom	developer email	tball@google.com	Low
Vendor	pom	developer id	tomball	Medium
Vendor	pom	developer name	Tom Ball	Medium
Vendor	pom	developer org	Google	Medium
Vendor	pom	developer org URL	https://www.google.com	Medium
Vendor	pom	groupid	com.google.j2objc	Highest
Vendor	pom	name	J2ObjC Annotations	High
Vendor	pom	url	google/j2objc/	Highest
Product	file	name	j2objc-annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	google	Highest
Product	jar	package name	j2objc	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	j2objc-annotations	Highest
Product	pom	developer email	tball@google.com	Low
Product	pom	developer id	tomball	Low
Product	pom	developer name	Tom Ball	Low
Product	pom	developer org	Google	Low
Product	pom	developer org URL	https://www.google.com	Low
Product	pom	groupid	com.google.j2objc	Highest
Product	pom	name	J2ObjC Annotations	High
Product	pom	url	google/j2objc/	High
Version	file	version	3.0.0	High
Version	pom	version	3.0.0	Highest

Identifiers

pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0 (Confidence:High)

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\code\findbugs\jsr305\3.0.2\jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.3

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsr305	High
Vendor	Manifest	bundle-symbolicname	org.jsr-305	Medium
Vendor	pom	artifactid	jsr305	Highest
Vendor	pom	artifactid	jsr305	Low
Vendor	pom	groupid	com.google.code.findbugs	Highest
Vendor	pom	name	FindBugs-jsr305	High
Vendor	pom	url	http://findbugs.sourceforge.net/	Highest
Product	file	name	jsr305	High
Product	Manifest	Bundle-Name	FindBugs-jsr305	Medium
Product	Manifest	bundle-symbolicname	org.jsr-305	Medium
Product	pom	artifactid	jsr305	Highest
Product	pom	groupid	com.google.code.findbugs	Highest
Product	pom	name	FindBugs-jsr305	High
Product	pom	url	http://findbugs.sourceforge.net/	Medium
Version	file	version	3.0.2	High
Version	Manifest	Bundle-Version	3.0.2	High
Version	pom	version	3.0.2	Highest

Identifiers

pkg:maven/com.google.code.findbugs/jsr305@3.0.2 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.38\lombok-1.18.38.jar\lombok\launch\mavenEcjBootstrapAgent.jar
MD5: 885d5d6be90a5dcd4b82cdf741e3f31a
SHA1: e1f7f1779f40157fd0b984c1bc32a0cb45cae66e
SHA256:74a80a6ee84e5c6fe497dfcc46a46dbe30578525e747eb531e918ee0750c8da9
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mavenEcjBootstrapAgent	High
Vendor	jar	package name	launch	Low
Vendor	jar	package name	lombok	Low
Vendor	Manifest	can-redefine-classes	true	Low
Product	file	name	mavenEcjBootstrapAgent	High
Product	jar	package name	launch	Low
Product	Manifest	can-redefine-classes	true	Low

Identifiers

None

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: https://projectlombok.org/LICENSE

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.38\lombok-1.18.38.jar
MD5: 789cacd8d3969e9d23e6e6baec747f70
SHA1: 57f8f5e02e92a30fd21b80cbd426a4172b5f8e29
SHA256:1e1e427c36ff63c44fd30ef292d9e773ea3154460ab6265d3fed7e6f5bc50fb9
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.104

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	lombok	High
Vendor	jar	package name	java	Highest
Vendor	jar	package name	lombok	Highest
Vendor	jar	package name	tostring	Highest
Vendor	Manifest	automatic-module-name	lombok	Medium
Vendor	Manifest	can-redefine-classes	true	Low
Vendor	pom	artifactid	lombok	Highest
Vendor	pom	artifactid	lombok	Low
Vendor	pom	developer email	reinier@projectlombok.org	Low
Vendor	pom	developer email	roel@projectlombok.org	Low
Vendor	pom	developer id	rspilker	Medium
Vendor	pom	developer id	rzwitserloot	Medium
Vendor	pom	developer name	Reinier Zwitserloot	Medium
Vendor	pom	developer name	Roel Spilker	Medium
Vendor	pom	groupid	org.projectlombok	Highest
Vendor	pom	name	Project Lombok	High
Vendor	pom	url	https://projectlombok.org	Highest
Product	file	name	lombok	High
Product	jar	package name	java	Highest
Product	jar	package name	lombok	Highest
Product	jar	package name	tostring	Highest
Product	Manifest	automatic-module-name	lombok	Medium
Product	Manifest	can-redefine-classes	true	Low
Product	pom	artifactid	lombok	Highest
Product	pom	developer email	reinier@projectlombok.org	Low
Product	pom	developer email	roel@projectlombok.org	Low
Product	pom	developer id	rspilker	Low
Product	pom	developer id	rzwitserloot	Low
Product	pom	developer name	Reinier Zwitserloot	Low
Product	pom	developer name	Roel Spilker	Low
Product	pom	groupid	org.projectlombok	Highest
Product	pom	name	Project Lombok	High
Product	pom	url	https://projectlombok.org	Medium
Version	file	version	1.18.38	High
Version	Manifest	lombok-version	1.18.38	Medium
Version	pom	version	1.18.38	Highest

Identifiers

pkg:maven/org.projectlombok/lombok@1.18.38 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\gaul\modernizer-maven-annotations\3.1.0\modernizer-maven-annotations-3.1.0.jar
MD5: b188aef3e94d39c7e7a8ebb6b740559f
SHA1: 06eeda8c72054cfccf610ae772f606dbd13acf32
SHA256:1b4e8adc970715721846afeb632edd1c9dc9c07dc052b691c0c8d899c9b9f017
Referenced In Project/Scope: tomcat9-config:provided
modernizer-maven-annotations-3.1.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.104

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	modernizer-maven-annotations	High
Vendor	jar	package name	gaul	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	modernizer-maven-annotations	Highest
Vendor	pom	artifactid	modernizer-maven-annotations	Low
Vendor	pom	groupid	org.gaul	Highest
Vendor	pom	name	Modernizer Maven Plugin annotations	High
Vendor	pom	parent-artifactid	modernizer-maven-parent	Low
Product	file	name	modernizer-maven-annotations	High
Product	jar	package name	gaul	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	modernizer-maven-annotations	Highest
Product	pom	groupid	org.gaul	Highest
Product	pom	name	Modernizer Maven Plugin annotations	High
Product	pom	parent-artifactid	modernizer-maven-parent	Medium
Version	file	version	3.1.0	High
Version	pom	version	3.1.0	Highest

Identifiers

pkg:maven/org.gaul/modernizer-maven-annotations@3.1.0 (Confidence:High)

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html

File Path: C:\Users\Jeremy\.m2\repository\com\github\spotbugs\spotbugs-annotations\4.9.3\spotbugs-annotations-4.9.3.jar
MD5: 6149845e438bd5a34ebaf81f8bc9e243
SHA1: 4d362bffcfdfd734999e94d7d98fde678aae71cf
SHA256:13532bfe2f45fcd491432221df72d9cd0efb8f987c9245e12befa192c8925ce3
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.104

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spotbugs-annotations	High
Vendor	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Vendor	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Vendor	pom	artifactid	spotbugs-annotations	Highest
Vendor	pom	artifactid	spotbugs-annotations	Low
Vendor	pom	developer email	andreas.sewe@codetrails.com	Low
Vendor	pom	developer email	dbrosius@mebigfatguy.com	Low
Vendor	pom	developer email	loskutov@gmx.de	Low
Vendor	pom	developer email	skypencil@gmail.com	Low
Vendor	pom	developer id	henrik242	Medium
Vendor	pom	developer id	iloveeclipse	Medium
Vendor	pom	developer id	jsotuyod	Medium
Vendor	pom	developer id	KengoTODA	Medium
Vendor	pom	developer id	mebigfatguy	Medium
Vendor	pom	developer id	sewe	Medium
Vendor	pom	developer id	ThrawnCA	Medium
Vendor	pom	developer name	Andreas Sewe	Medium
Vendor	pom	developer name	Andrey Loskutov	Medium
Vendor	pom	developer name	Dave Brosius	Medium
Vendor	pom	developer name	Juan Martín Sotuyo Dodero	Medium
Vendor	pom	developer name	Kengo TODA	Medium
Vendor	pom	groupid	com.github.spotbugs	Highest
Vendor	pom	name	SpotBugs Annotations	High
Vendor	pom	url	https://spotbugs.github.io/	Highest
Product	file	name	spotbugs-annotations	High
Product	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Product	Manifest	Bundle-Name	spotbugs-annotations	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Product	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Product	pom	artifactid	spotbugs-annotations	Highest
Product	pom	developer email	andreas.sewe@codetrails.com	Low
Product	pom	developer email	dbrosius@mebigfatguy.com	Low
Product	pom	developer email	loskutov@gmx.de	Low
Product	pom	developer email	skypencil@gmail.com	Low
Product	pom	developer id	henrik242	Low
Product	pom	developer id	iloveeclipse	Low
Product	pom	developer id	jsotuyod	Low
Product	pom	developer id	KengoTODA	Low
Product	pom	developer id	mebigfatguy	Low
Product	pom	developer id	sewe	Low
Product	pom	developer id	ThrawnCA	Low
Product	pom	developer name	Andreas Sewe	Low
Product	pom	developer name	Andrey Loskutov	Low
Product	pom	developer name	Dave Brosius	Low
Product	pom	developer name	Juan Martín Sotuyo Dodero	Low
Product	pom	developer name	Kengo TODA	Low
Product	pom	groupid	com.github.spotbugs	Highest
Product	pom	name	SpotBugs Annotations	High
Product	pom	url	https://spotbugs.github.io/	Medium
Version	file	version	4.9.3	High
Version	Manifest	Bundle-Version	4.9.3	High
Version	pom	version	4.9.3	Highest

Identifiers

pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.3 (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\annotations-api.jar
MD5: 34297ad06ed9bd4a0b725fe6dadcb1e6
SHA1: 4d4c410ac37e4465f39939e6c564eff6c690fa18
SHA256:91cecc44003b16421d0ec07c781b87d038c2e3c47a5a529439a9935ebbb81a5d
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	annotations-api	High
Vendor	jar	package name	annotation	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Vendor	manifest: javax/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/security/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/sql/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	annotations-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	annotation	Low
Product	jar	package name	javax	Highest
Product	jar	package name	security	Highest
Product	jar	package name	sql	Highest
Product	Manifest	Bundle-Name	tomcat-annotations-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Product	manifest: javax/annotation/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/security/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/security/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/sql/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/sql/	Specification-Title	Common Annotations	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	security	Highest
Version	jar	package name	sql	Highest
Version	Manifest	Bundle-Version	9.0.104	High
Version	manifest: javax/annotation/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/security/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/sql/	Implementation-Version	1.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\bin\bootstrap.jar
MD5: cc72489893ec452683c980a46281ebf1
SHA1: fde80efad97776d5364a3633725cc13bfbdf2d02
SHA256:396862a9299d7b47bfd3f6154a1018d6e5a81fd8efd945af2a7b5450580b8497
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	bootstrap	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	startup	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	bootstrap	High
Product	jar	package name	apache	Highest
Product	jar	package name	bootstrap	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	startup	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Implementation-Title	Apache Tomcat Bootstrap	High
Product	Manifest	specification-title	Apache Tomcat Bootstrap	Medium
Version	Manifest	Implementation-Version	9.0.104	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\catalina-ant.jar
MD5: 7abaf9c96cf9cf0b94ac9a6e68491713
SHA1: e3e55ecbe88996fe4b1e3a2c35b25b1abd1419af
SHA256:c51fb15392b4c567f9ca37e79c8c5ef743de33c15eb6e5bf739d150090394383
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ant	High
Vendor	jar	package name	ant	Low
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ant	High
Product	jar	package name	ant	Low
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Low
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Implementation-Version	9.0.104	High

Identifiers

cpe:2.3:a:apache:ant:9.0.104:*:*:*:*:*:*:* (Confidence:High)
cpe:2.3:a:apache:tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\catalina-ha.jar
MD5: 2e65f865687ba799bab3f3a9b71ba7d9
SHA1: 8847ff255ab2be7976131514ea4d5845ea1d3a0e
SHA256:ba3904bc28d3c58bd56012c0833b9a1346391b1ee116a26b4672cdb0d8a501b1
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ha	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	ha	Highest
Vendor	jar	package name	ha	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ha	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	ha	Highest
Product	jar	package name	ha	Low
Product	Manifest	Bundle-Name	tomcat-catalina-ha	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.104	High
Version	Manifest	Implementation-Version	9.0.104	High

Related Dependencies

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\catalina.jar
MD5: 9b51ef76158a04934940c0ccb5ac1fca
SHA1: f2b79124fd487c79972d1a5e63ef613466747213
SHA256:c61f01fe4de48705c758d97b8e14c980ddfd6bef6d424409547dedf29d0c37cf
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-catalina	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.104	High
Version	Manifest	Implementation-Version	9.0.104	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Highest)

Description:

    Apache Commons Daemon software is a set of utilities and Java support
    classes for running Java applications as server processes. These are
    commonly known as 'daemon' processes in Unix terminology (hence the
    name). On Windows they are called 'services'.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\bin\commons-daemon.jar
MD5: 00d973e42c1620f71f81e6c78d02fa2d
SHA1: 8308391bc284f7890139b58272819480594135fb
SHA256:fd306f20fbe9ab60c2e06a8b8bdda786d8d2e1a10bfe475cde89f1b7864f4e7e
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-daemon	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	daemon	Highest
Vendor	jar	package name	support	Highest
Vendor	Manifest	build-jdk-spec	23	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.apache	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-daemon	Low
Vendor	pom	developer email	billbarker at apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	jfclere at apache.org	Low
Vendor	pom	developer email	mturk at apache.org	Low
Vendor	pom	developer email	pier at apache.org	Low
Vendor	pom	developer email	remm at apache.org	Low
Vendor	pom	developer email	yoavs at apache.org	Low
Vendor	pom	developer id	billbarker	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	jfclere	Medium
Vendor	pom	developer id	mturk	Medium
Vendor	pom	developer id	pier	Medium
Vendor	pom	developer id	remm	Medium
Vendor	pom	developer id	yoavs	Medium
Vendor	pom	developer name	Bill Barker	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Jean-Frederic Clere	Medium
Vendor	pom	developer name	Mladen Turk	Medium
Vendor	pom	developer name	Pier Fumagalli	Medium
Vendor	pom	developer name	Remy Maucherat	Medium
Vendor	pom	developer name	Yoav Shapira	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-daemon	Highest
Vendor	pom	name	Apache Commons Daemon	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-daemon/	Highest
Product	file	name	commons-daemon	High
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	daemon	Highest
Product	jar	package name	support	Highest
Product	Manifest	build-jdk-spec	23	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Product	Manifest	Bundle-Name	Apache Commons Daemon	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Product	Manifest	Implementation-Title	Apache Commons Daemon	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons Daemon	Medium
Product	pom	artifactid	commons-daemon	Highest
Product	pom	developer email	billbarker at apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	jfclere at apache.org	Low
Product	pom	developer email	mturk at apache.org	Low
Product	pom	developer email	pier at apache.org	Low
Product	pom	developer email	remm at apache.org	Low
Product	pom	developer email	yoavs at apache.org	Low
Product	pom	developer id	billbarker	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	jfclere	Low
Product	pom	developer id	mturk	Low
Product	pom	developer id	pier	Low
Product	pom	developer id	remm	Low
Product	pom	developer id	yoavs	Low
Product	pom	developer name	Bill Barker	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Jean-Frederic Clere	Low
Product	pom	developer name	Mladen Turk	Low
Product	pom	developer name	Pier Fumagalli	Low
Product	pom	developer name	Remy Maucherat	Low
Product	pom	developer name	Yoav Shapira	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-daemon	Highest
Product	pom	name	Apache Commons Daemon	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-daemon/	Medium
Version	Manifest	Bundle-Version	1.4.1	High
Version	Manifest	Implementation-Version	1.4.1	High
Version	pom	parent-version	1.4.1	Low
Version	pom	version	1.4.1	Highest

Identifiers

pkg:maven/commons-daemon/commons-daemon@1.4.1 (Confidence:High)
cpe:2.3:a:apache:apache_commons_daemon:1.4.1:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\ecj-4.20.jar
MD5: ee47966a67cd4019f1b8ccac74ba8dca
SHA1: 4837be609a3368a0f7e7cf0dc1bdbc7fe94993de
SHA256:ac0ba5876eaf7ebb47749a0d1be179c51f194b9dd0b875d1c09e1b530f5a2db5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	ecj	High
Vendor	jar	package name	compiler	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	eclipse	Low
Vendor	jar	package name	internal	Low
Vendor	jar	package name	jdt	Highest
Vendor	jar	package name	jdt	Low
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Product	file	name	ecj	High
Product	jar	package name	compiler	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	core	Highest
Product	jar	package name	eclipse	Highest
Product	jar	package name	internal	Low
Product	jar	package name	jdt	Highest
Product	jar	package name	jdt	Low
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	Eclipse Compiler for Java(TM)	Medium
Product	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Version	file	name	ecj	Medium
Version	file	version	4.20	High
Version	Manifest	build-jdk-spec	11	Low
Version	Manifest	Bundle-Version	3.26.0.v20210609-0549	High

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\el-api.jar
MD5: 88d4028b31648be98c2039911e424455
SHA1: 4f8ac739d7c4ba2b78c232456a08481ed86a5f42
SHA256:6a72c14775b2b230d3a2c1b019d8aed0d44ebeff6a17338bdcf7b45a49e973d3
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Vendor	manifest: javax/el/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expression	Highest
Product	jar	package name	javax	Highest
Product	Manifest	Bundle-Name	tomcat-el-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Product	manifest: javax/el/	Implementation-Title	javax.el	Medium
Product	manifest: javax/el/	Specification-Title	Expression Language	Medium
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.104	High
Version	manifest: javax/el/	Implementation-Version	3.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-0493

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST
cve@mitre.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0044

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2000-0760

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2000-0672

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

CVE-2000-1210

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

CVE-2001-0590

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0042

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0043

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0045

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-0808

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\jasper-el.jar
MD5: c567e015890c7db7a209e68535a7aefc
SHA1: 3bd356ec53f88535fb7f05055fc1ebd4bcf9b3ef
SHA256:cf806df59b4189bb5a14ea843c93f577c132c07582ca0bdb8370c3c73dfa1890
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	parser	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expressionfactoryimpl	Highest
Product	jar	package name	parser	Low
Product	Manifest	Bundle-Name	tomcat-jasper-el	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	jar	package name	apache	Highest
Version	jar	package name	el	Highest
Version	jar	package name	expressionfactoryimpl	Highest
Version	Manifest	Bundle-Version	9.0.104	High
Version	Manifest	Implementation-Version	9.0.104	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\jasper.jar
MD5: ed082b5094e56f75efd265b07274b3ee
SHA1: d71301c5adcde71c1363ae6f4b65768d7798ae49
SHA256:411ca9f8fba409b84c1a6cf9c4ff20f129852bd43bceae8d6c26898a5bf6cace
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	compiler	Low
Vendor	jar	package name	jasper	Highest
Vendor	jar	package name	jasper	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper	High
Product	jar	package name	apache	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	jasper	Highest
Product	jar	package name	jasper	Low
Product	Manifest	Bundle-Name	tomcat-jasper	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.104	High
Version	Manifest	Implementation-Version	9.0.104	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\jaspic-api.jar
MD5: 3703b9c37c7c8d7a52f31c5ed3a344ef
SHA1: f809e5fc39c9cd4a029a56973a71fd2de6a2cb3c
SHA256:d9d908e0b6ebf947549e7d21446a9d17784160121cd135b2a00ed517ff748223
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jaspic-api	High
Vendor	jar	package name	auth	Low
Vendor	jar	package name	javax	Low
Vendor	jar	package name	security	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Vendor	manifest: javax/security/auth/message/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/callback/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/config/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/module/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jaspic-api	High
Product	jar	package name	auth	Highest
Product	jar	package name	auth	Low
Product	jar	package name	javax	Highest
Product	jar	package name	message	Highest
Product	jar	package name	message	Low
Product	jar	package name	security	Highest
Product	jar	package name	security	Low
Product	Manifest	Bundle-Name	tomcat-jaspic-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Product	manifest: javax/security/auth/message/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/callback/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/callback/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/config/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/config/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/module/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/module/	Specification-Title	Java Authentication SPI for Containers	Medium
Version	jar	package name	auth	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	message	Highest
Version	jar	package name	security	Highest
Version	Manifest	Bundle-Version	9.0.104	High
Version	manifest: javax/security/auth/message/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/callback/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/config/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/module/	Implementation-Version	1.1.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\jsp-api.jar
MD5: f7a6d646b1c1b9ca0e91cc504bf15f55
SHA1: 12d1c5885fe4e3c860fcf2813fde33c4ebf7a75a
SHA256:55e0e11b9e2ffe6be9fb16479921493f8a9fdca4901011a89c6692d8c900ad34
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsp-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	jsp	Low
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Vendor	manifest: javax/servlet/jsp/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/tagext/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jsp-api	High
Product	jar	package name	el	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	jsp	Low
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	jar	package name	tagext	Highest
Product	Manifest	Bundle-Name	tomcat-jsp-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Product	manifest: javax/servlet/jsp/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/el/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/el/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/resources/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/resources/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/tagext/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/tagext/	Specification-Title	Java API for JavaServer Pages	Medium
Version	jar	package name	el	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	servlet	Highest
Version	jar	package name	tagext	Highest
Version	Manifest	Bundle-Version	9.0.104	High
Version	manifest: javax/servlet/jsp/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/el/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/resources/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/tagext/	Implementation-Version	2.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\webapps\docs\appdev\sample\sample.war
MD5: 570f196c4a1025a717269d16d11d6f37
SHA1: 80f5053b166c69d81697ba21113c673f8372aca0
SHA256:89b33caa5bf4cfd235f060c396cb1a5acb2734a1366db325676f48c5f5ed92e5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	sample	High
Vendor	jar	package name	classes	Low
Vendor	jar	package name	mypackage	Low
Vendor	jar	package name	web-inf	Low
Product	file	name	sample	High
Product	jar	package name	classes	Low
Product	jar	package name	hello	Low
Product	jar	package name	mypackage	Low

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\servlet-api.jar
MD5: 15ba1de97b47a9ef5bf5bd0626a04810
SHA1: af90c6d8664cc9d69e3e1bad3cf69e4996524071
SHA256:45144d1574e8175461333a22ca5933e1675920e771682833245afca870d7e580
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	servlet-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	servlet	Highest
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Vendor	manifest: javax/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	servlet-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	Manifest	Bundle-Name	tomcat-servlet-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Product	manifest: javax/servlet/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/annotation/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/annotation/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/descriptor/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/descriptor/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/http/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/http/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/resources/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/resources/	Specification-Title	Java API for Servlets	Medium
Version	jar	package name	annotation	Highest
Version	jar	package name	descriptor	Highest
Version	jar	package name	http	Highest
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.104	High
Version	manifest: javax/servlet/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/annotation/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/descriptor/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/http/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/resources/	Implementation-Version	4.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2272

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSSv2:

Base Score: HIGH (7.8)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
cve@mitre.org - EXPLOIT,PATCH
cve@mitre.org - PATCH

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

NVD-CWE-Other

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0866

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-1355

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
secalert@redhat.com - EXPLOIT,PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-3383

Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,US_GOVERNMENT_RESOURCE
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - TOOL_SIGNATURE
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - TOOL_SIGNATURE
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-2450

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-5461

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
secalert@redhat.com - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-5519

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - EXPLOIT,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

        An implementation of the JSP Standard Tag Library (JSTL).

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\webapps\examples\WEB-INF\lib\taglibs-standard-impl-1.2.5.jar
MD5: 8e5c8db242fbef3db1acfcbb3bc8ec8b
SHA1: 9b9783ccb2a323383e6e20e36d368f8997b71967
SHA256:d075cb77d94e2d115b4d90a897b57d65cc31ed8e1b95d65361da324642705728
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	taglibs-standard-impl	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	standard	Highest
Vendor	jar	package name	tag	Highest
Vendor	jar	package name	taglibs	Highest
Vendor	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Vendor	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Vendor	pom	artifactid	taglibs-standard-impl	Low
Vendor	pom	developer name	Bjorn Townsend	Medium
Vendor	pom	developer name	Dmitri Plotnikov	Medium
Vendor	pom	developer name	Felipe Leme	Medium
Vendor	pom	developer name	Glenn Nielsen	Medium
Vendor	pom	developer name	Hans Bergsten	Medium
Vendor	pom	developer name	Henri Yandell	Medium
Vendor	pom	developer name	Jan Luehe	Medium
Vendor	pom	developer name	Justyna Horwat	Medium
Vendor	pom	developer name	Mark Kolb	Medium
Vendor	pom	developer name	Nathan Abramson	Medium
Vendor	pom	developer name	Pierre Delisle	Medium
Vendor	pom	developer name	Scott Hasse	Medium
Vendor	pom	developer name	Shawn Bayern	Medium
Vendor	pom	groupid	org.apache.taglibs	Highest
Vendor	pom	name	Apache Standard Taglib Implementation	High
Vendor	pom	parent-artifactid	taglibs-standard	Low
Product	file	name	taglibs-standard-impl	High
Product	jar	package name	apache	Highest
Product	jar	package name	standard	Highest
Product	jar	package name	tag	Highest
Product	jar	package name	taglibs	Highest
Product	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Product	Manifest	Bundle-Name	Apache Standard Taglib Implementation	Medium
Product	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Product	Manifest	Implementation-Title	Apache Standard Taglib Implementation	High
Product	pom	artifactid	taglibs-standard-impl	Highest
Product	pom	developer name	Bjorn Townsend	Low
Product	pom	developer name	Dmitri Plotnikov	Low
Product	pom	developer name	Felipe Leme	Low
Product	pom	developer name	Glenn Nielsen	Low
Product	pom	developer name	Hans Bergsten	Low
Product	pom	developer name	Henri Yandell	Low
Product	pom	developer name	Jan Luehe	Low
Product	pom	developer name	Justyna Horwat	Low
Product	pom	developer name	Mark Kolb	Low
Product	pom	developer name	Nathan Abramson	Low
Product	pom	developer name	Pierre Delisle	Low
Product	pom	developer name	Scott Hasse	Low
Product	pom	developer name	Shawn Bayern	Low
Product	pom	groupid	org.apache.taglibs	Highest
Product	pom	name	Apache Standard Taglib Implementation	High
Product	pom	parent-artifactid	taglibs-standard	Medium
Version	file	version	1.2.5	High
Version	Manifest	Bundle-Version	1.2.5	High
Version	Manifest	Implementation-Version	1.2.5	High
Version	pom	version	1.2.5	Highest

Related Dependencies

Identifiers

pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5 (Confidence:High)
cpe:2.3:a:apache:standard_taglibs:1.2.5:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-api.jar
MD5: 0e42a98180ddddc6880207170cc5e021
SHA1: 1df76a507ea5a638bc018e7d2a536b76c239ad7c
SHA256:c9ae0e94afda44079499da6d8509df567a0cb3196a4995698af100aa0f2ea999
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-api	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	tomcat	Highest
Vendor	jar	package name	tomcat	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-api	High
Product	jar	package name	apache	Highest
Product	jar	package name	tomcat	Highest
Product	jar	package name	tomcat	Low
Product	Manifest	Bundle-Name	tomcat-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.104	High
Version	Manifest	Implementation-Version	9.0.104	High

Related Dependencies

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-coyote-ffm.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-coyote-ffm.jar
- MD5: 068e69923cacc47c4c58ade06dbb4e58
- SHA1: eb2518c159e5735759d8ec91c2f6010f45282f1f
- SHA256: b677bd04b30bee3519a15f85ee2dcda18db7d4b66b48e1917745a71e91e048d5
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-coyote.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-coyote.jar
- MD5: ba506df3f241c3262a00cc24e98f532a
- SHA1: 9d6fd2489f0e31464b60890ed58b133d2685701c
- SHA256: 22f291940671b9e8248127ec993d93d6d3238ee0396ef5570ee91faef7365487
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-dbcp.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-dbcp.jar
- MD5: d1fd99a7da7823a5e4ee39a029c4c55c
- SHA1: 1480d46cb60167ab2e17aca10c36b86d08de8df7
- SHA256: aa2127ba2da7739f88694e080ac9d74ba2f54f7cae84c209555bc34a20f3be98
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-jdbc.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-jdbc.jar
- MD5: 2fefe35acaa448122c774323403be5e2
- SHA1: eba18abe2ee4fabd293b670522fd502fbc67c889
- SHA256: 8b76def36d4b316f7529857f9b54ee3e0a8c0c601e016c0040006edcd0858ac1
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-jni.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-jni.jar
- MD5: f946a5f5ad151604b7aef89a0c6c27a8
- SHA1: 4b170de76de64263ff4b5ed52c82e1c3f86b0024
- SHA256: a7a288c5770fa14c0080b7e9d474a8d4c877c8eb102756e1fdbec242685ce269
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-util-scan.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-util-scan.jar
- MD5: 73f896b268a03041a5cd419bc16bf5ac
- SHA1: 4a315c4769a41aeb3d86b0f9fd21f4f37849fe81
- SHA256: f6761eb84ee7a246273c9894a26e1826f9d997f1c85a041331b76162d1f4c27d
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-util.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-util.jar
- MD5: 70de18269b87f051c6840e8964060509
- SHA1: 1eefb73dd38e85f7d280b053bf441d718b4c3ddd
- SHA256: 5a4372c77b2bbfe4de66116704bf4ed067cd0be14752d2c52b03dee7ae4150de

Identifiers

cpe:2.3:a:apache:tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-i18n-cs.jar
MD5: fe10749cee6462e560ba586f476dba0d
SHA1: f77aad189cc23a37a00e1589bdae600cf00c61c1
SHA256:8af3ed704d0bbb39d9b31539863a1d8485f8f272af86582973ef802db5ee3a10
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-cs	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-cs	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-cs	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.104	High

Related Dependencies

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-i18n-de.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-i18n-de.jar
- MD5: 47e3235067a53e3d115c45d0c51141df
- SHA1: 7dc7148240636682e14f5b03ff545dce65e3f165
- SHA256: 61982c55782060b884808381fb00be3afca346f35b84cdf3cce770fdf44aebad
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-i18n-es.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-i18n-es.jar
- MD5: afc043c91d659e91c2da970bd95a1691
- SHA1: f9ef96df4ae1cc2018819418c3d829b4020f966c
- SHA256: 26a64ee59a3ec568f801b3316215a9192dd0a97c78e173ada60f32912ab2afd0
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-i18n-ja.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-i18n-ja.jar
- MD5: 61e7a2681f2034bd71c94e6357036334
- SHA1: 045e9363159217373f5f5490c4cac58cc3a31aba
- SHA256: 85ff581c5379b3f71bbf44ed446ed0a36c0f9143f11277d0b3a6add196f171c1
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-i18n-ko.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-i18n-ko.jar
- MD5: 0ec75c8548224758f96f26427bd92b87
- SHA1: facdb134c3f79cdaf826d63a2fe48d87d628f7b8
- SHA256: 04a030fcf3cfe782d05d1d2a8e522d24e3d129336934cf4e8bf2839231b3527a
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-i18n-pt-BR.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-i18n-pt-BR.jar
- MD5: 8f5433ee8f5b351e073b83538531f598
- SHA1: e3a49567cdb686f3c6411528dd96ec6ab69e90a4
- SHA256: d449e04373a702718f3760f514d8b93a16be98a1716d52c84a18bc986d9d1a4c
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-i18n-ru.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-i18n-ru.jar
- MD5: 94815cc5b5cced333c7ae6f1b80d23cf
- SHA1: 49303214525c4b0d09db8cca10fd206087bf1e86
- SHA256: 5c9f00f5b78f45c5b94f730b04af741febe4ad2aaa1d095f4e36339327958cdc
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-i18n-zh-CN.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-i18n-zh-CN.jar
- MD5: e533a7395681d0c1101ba1149753f1f2
- SHA1: 6c3d7cfe4e32fefa161bffde06bb01fff8b9f2f1
- SHA256: c3cb0ec2b4dd18c997eceb44fd0748ac88be7d1b7292e34cd342f2b43f97a720
tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-websocket.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-websocket.jar
- MD5: 905cac663d64dab5af9c5bcf77bcc8fd
- SHA1: f1cb8a1d7c99269324192581bbcef34c3c21ed39
- SHA256: 1785a882b34738d0719460140752a295b159e0b0ba3d3e133556d8f486ad19a3

Identifiers

cpe:2.3:a:apache:tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\tomcat-i18n-fr.jar
MD5: 1c32ab2cee4ce8b2ad4b46f17844b22c
SHA1: a5741c2175094c489489c0396ef64e2eb3df87f7
SHA256:89152515c0d7540071180bfcd5b7df390a1ee7b5be00632ea9a68a2d257b7502
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-fr	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-fr	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-fr	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.104	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:nfr:nfr:9.0.104:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\bin\tomcat-juli.jar
MD5: b028cd20111ec75f8b05e513b865d662
SHA1: e1412ff96df0220ab9502f373c48e3381fbc1db7
SHA256:eadea9d1d715f448fc12709c0a990a8277cca1ee97ea5aae941b375dec2f268b
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-juli	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	juli	Highest
Vendor	jar	package name	juli	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-juli	High
Product	jar	package name	apache	Highest
Product	jar	package name	juli	Highest
Product	jar	package name	juli	Low
Product	Manifest	Bundle-Name	tomcat-juli	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.104	High
Version	Manifest	Implementation-Version	9.0.104	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.104:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.104\tomcat-9.0.104.tar.gz\tomcat-9.0.104.tar\apache-tomcat-9.0.104\lib\websocket-api.jar
MD5: d6773d6aa8d1ec43681ad747b34a3dbc
SHA1: 9b28a8b293970234d067a306b1731caca431b170
SHA256:bb58a63fba154712da0e970a6e0ec985be331c179e96a1e2714842a54d728e17
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	websocket-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	websocket	Highest
Vendor	jar	package name	websocket	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Vendor	manifest: javax/websocket/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/websocket/server/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	websocket-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	server	Highest
Product	jar	package name	websocket	Highest
Product	jar	package name	websocket	Low
Product	Manifest	Bundle-Name	tomcat-websocket-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Product	manifest: javax/websocket/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/	Specification-Title	WebSocket	Medium
Product	manifest: javax/websocket/server/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/server/	Specification-Title	WebSocket	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	server	Highest
Version	Manifest	Bundle-Version	9.0.104	High
Version	manifest: javax/websocket/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/websocket/server/	Implementation-Version	1.1.FR	Medium

Identifiers

None

How to read the report | Suppressing false positives | Getting Help: github issues Sponsor

Project: tomcat9-config

com.github.hazendaz.tomcat:tomcat9-config:9.0.104

Summary

Dependencies (vulnerable)

checker-qual-3.49.2.jar

Evidence

Identifiers

error_prone_annotations-2.37.0.jar

Evidence

Identifiers

j2objc-annotations-3.0.0.jar

Evidence

Identifiers

jsr305-3.0.2.jar

Evidence

Identifiers

lombok-1.18.38.jar: mavenEcjBootstrapAgent.jar

Evidence

Identifiers

lombok-1.18.38.jar

Evidence

Identifiers

modernizer-maven-annotations-3.1.0.jar

Evidence

Identifiers

spotbugs-annotations-4.9.3.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: annotations-api.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: bootstrap.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: catalina-ant.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: catalina-ha.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: catalina.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: commons-daemon.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: ecj-4.20.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: el-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: jasper-el.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: jasper.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: jaspic-api.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: jsp-api.jar

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: sample.war

Evidence

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: servlet-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: taglibs-standard-impl-1.2.5.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.104.tar.gz: tomcat-9.0.104.tar: tomcat-api.jar

Evidence

How to read the report | Suppressing false positives | Getting Help: github issues

Sponsor