Dependency-Check Report

Dependency	Vulnerability IDs	Package	Highest Severity	CVE Count	Confidence	Evidence Count
checker-qual-3.49.0.jar		pkg:maven/org.checkerframework/checker-qual@3.49.0		0		44
error_prone_annotations-2.36.0.jar		pkg:maven/com.google.errorprone/error_prone_annotations@2.36.0		0		29
j2objc-annotations-3.0.0.jar		pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0		0		33
jsr305-3.0.2.jar		pkg:maven/com.google.code.findbugs/jsr305@3.0.2		0		17
lombok-1.18.36.jar: mavenEcjBootstrapAgent.jar				0		7
lombok-1.18.36.jar		pkg:maven/org.projectlombok/lombok@1.18.36		0		36
modernizer-maven-annotations-3.1.0.jar		pkg:maven/org.gaul/modernizer-maven-annotations@3.1.0		0		19
spotbugs-annotations-4.9.1.jar		pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.1		0		53
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: annotations-api.jar	cpe:2.3:a:apache:tomcat:9.0.102:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Low	30
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: bootstrap.jar	cpe:2.3:a:apache:tomcat:9.0.102:::::::*			0	Highest	16
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: catalina-ant.jar	cpe:2.3:a:apache:ant:9.0.102:::::::* cpe:2.3:a:apache:tomcat:9.0.102:::::::*			0	High	14
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: catalina-ha.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Highest	22
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: catalina.jar	cpe:2.3:a:apache:tomcat:9.0.102:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Highest	20
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: commons-daemon.jar	cpe:2.3:a:apache:apache_commons_daemon:1.4.1:::::::*	pkg:maven/commons-daemon/commons-daemon@1.4.1		0	Low	86
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: ecj-4.20.jar				0		25
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: el-api.jar	cpe:2.3:a:apache:tomcat:3.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*		CRITICAL*	31	Medium	20
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: jasper-el.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Low	26
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: jasper.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Highest	20
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: jaspic-api.jar	cpe:2.3:a:apache:tomcat:9.0.102:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Low	38
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: jsp-api.jar	cpe:2.3:a:apache:tomcat:9.0.102:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Low	39
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: sample.war				0		8
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: servlet-api.jar	cpe:2.3:a:apache:tomcat:4.0.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*		CRITICAL*	30	Medium	41
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: taglibs-standard-impl-1.2.5.jar	cpe:2.3:a:apache:standard_taglibs:1.2.5:::::::*	pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5		0	Highest	54
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-api.jar	cpe:2.3:a:apache:tomcat:9.0.102:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Highest	18
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-i18n-cs.jar	cpe:2.3:a:apache:tomcat:9.0.102:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Low	9
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-i18n-fr.jar	cpe:2.3:a:apache:tomcat:9.0.102:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::* cpe:2.3:a:nfr:nfr:9.0.102:::::::*			0	Low	9
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-juli.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:::::::*			0	Highest	18
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: websocket-api.jar				0		25

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: http://opensource.org/licenses/MIT

File Path: C:\Users\Jeremy\.m2\repository\org\checkerframework\checker-qual\3.49.0\checker-qual-3.49.0.jar
MD5: 308726c2d700ebe3d3377930adedb8c4
SHA1: 54be36cb42c9b991c109e467e2bfa82af4cda44e
SHA256:8b9d9a36eaaf7c0fc26503c83cd97d8c9c0f9e2913cc2a6e92ac26c735d4dcbe
Referenced In Project/Scope: tomcat9-config:compile
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.102

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	checker-qual	High
Vendor	jar	package name	checker	Highest
Vendor	jar	package name	checkerframework	Highest
Vendor	jar	package name	framework	Highest
Vendor	jar	package name	qual	Highest
Vendor	Manifest	bundle-symbolicname	checker-qual	Medium
Vendor	Manifest	implementation-url	https://checkerframework.org	Low
Vendor	pom	artifactid	checker-qual	Highest
Vendor	pom	artifactid	checker-qual	Low
Vendor	pom	developer email	mernst@cs.washington.edu	Low
Vendor	pom	developer email	smillst@cs.washington.edu	Low
Vendor	pom	developer id	mernst	Medium
Vendor	pom	developer id	smillst	Medium
Vendor	pom	developer name	Michael Ernst	Medium
Vendor	pom	developer name	Suzanne Millstein	Medium
Vendor	pom	developer org	University of Washington	Medium
Vendor	pom	developer org URL	https://www.cs.washington.edu/	Medium
Vendor	pom	groupid	org.checkerframework	Highest
Vendor	pom	name	Checker Qual	High
Vendor	pom	url	https://checkerframework.org/	Highest
Product	file	name	checker-qual	High
Product	jar	package name	checker	Highest
Product	jar	package name	checkerframework	Highest
Product	jar	package name	framework	Highest
Product	jar	package name	qual	Highest
Product	Manifest	Bundle-Name	checker-qual	Medium
Product	Manifest	bundle-symbolicname	checker-qual	Medium
Product	Manifest	implementation-url	https://checkerframework.org	Low
Product	pom	artifactid	checker-qual	Highest
Product	pom	developer email	mernst@cs.washington.edu	Low
Product	pom	developer email	smillst@cs.washington.edu	Low
Product	pom	developer id	mernst	Low
Product	pom	developer id	smillst	Low
Product	pom	developer name	Michael Ernst	Low
Product	pom	developer name	Suzanne Millstein	Low
Product	pom	developer org	University of Washington	Low
Product	pom	developer org URL	https://www.cs.washington.edu/	Low
Product	pom	groupid	org.checkerframework	Highest
Product	pom	name	Checker Qual	High
Product	pom	url	https://checkerframework.org/	Medium
Version	file	version	3.49.0	High
Version	Manifest	Bundle-Version	3.49.0	High
Version	Manifest	Implementation-Version	3.49.0	High
Version	pom	version	3.49.0	Highest

Identifiers

pkg:maven/org.checkerframework/checker-qual@3.49.0 (Confidence:High)

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\errorprone\error_prone_annotations\2.36.0\error_prone_annotations-2.36.0.jar
MD5: 0e48e5ba2cd0a8d8d09bad849b99f6a6
SHA1: 227d4d4957ccc3dc5761bd897e3a0ee587e750a7
SHA256:77440e270b0bc9a249903c5a076c36a722c4886ca4f42675f2903a1c53ed61a5
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.102

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	error_prone_annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	errorprone	Highest
Vendor	jar	package name	google	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Vendor	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	error_prone_annotations	Highest
Vendor	pom	artifactid	error_prone_annotations	Low
Vendor	pom	groupid	com.google.errorprone	Highest
Vendor	pom	name	error-prone annotations	High
Vendor	pom	parent-artifactid	error_prone_parent	Low
Product	file	name	error_prone_annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	errorprone	Highest
Product	jar	package name	google	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Product	Manifest	Bundle-Name	error-prone annotations	Medium
Product	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	error_prone_annotations	Highest
Product	pom	groupid	com.google.errorprone	Highest
Product	pom	name	error-prone annotations	High
Product	pom	parent-artifactid	error_prone_parent	Medium
Version	file	version	2.36.0	High
Version	Manifest	Bundle-Version	2.36.0	High
Version	pom	version	2.36.0	Highest

Identifiers

pkg:maven/com.google.errorprone/error_prone_annotations@2.36.0 (Confidence:High)

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\j2objc\j2objc-annotations\3.0.0\j2objc-annotations-3.0.0.jar
MD5: f59529b29202a5baf37f491ea5ec8627
SHA1: 7399e65dd7e9ff3404f4535b2f017093bdb134c7
SHA256:88241573467ddca44ffd4d74aa04c2bbfd11bf7c17e0c342c94c9de7a70a7c64
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.102

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	j2objc-annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	google	Highest
Vendor	jar	package name	j2objc	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	j2objc-annotations	Highest
Vendor	pom	artifactid	j2objc-annotations	Low
Vendor	pom	developer email	tball@google.com	Low
Vendor	pom	developer id	tomball	Medium
Vendor	pom	developer name	Tom Ball	Medium
Vendor	pom	developer org	Google	Medium
Vendor	pom	developer org URL	https://www.google.com	Medium
Vendor	pom	groupid	com.google.j2objc	Highest
Vendor	pom	name	J2ObjC Annotations	High
Vendor	pom	url	google/j2objc/	Highest
Product	file	name	j2objc-annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	google	Highest
Product	jar	package name	j2objc	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	j2objc-annotations	Highest
Product	pom	developer email	tball@google.com	Low
Product	pom	developer id	tomball	Low
Product	pom	developer name	Tom Ball	Low
Product	pom	developer org	Google	Low
Product	pom	developer org URL	https://www.google.com	Low
Product	pom	groupid	com.google.j2objc	Highest
Product	pom	name	J2ObjC Annotations	High
Product	pom	url	google/j2objc/	High
Version	file	version	3.0.0	High
Version	pom	version	3.0.0	Highest

Identifiers

pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0 (Confidence:High)

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\code\findbugs\jsr305\3.0.2\jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.1

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsr305	High
Vendor	Manifest	bundle-symbolicname	org.jsr-305	Medium
Vendor	pom	artifactid	jsr305	Highest
Vendor	pom	artifactid	jsr305	Low
Vendor	pom	groupid	com.google.code.findbugs	Highest
Vendor	pom	name	FindBugs-jsr305	High
Vendor	pom	url	http://findbugs.sourceforge.net/	Highest
Product	file	name	jsr305	High
Product	Manifest	Bundle-Name	FindBugs-jsr305	Medium
Product	Manifest	bundle-symbolicname	org.jsr-305	Medium
Product	pom	artifactid	jsr305	Highest
Product	pom	groupid	com.google.code.findbugs	Highest
Product	pom	name	FindBugs-jsr305	High
Product	pom	url	http://findbugs.sourceforge.net/	Medium
Version	file	version	3.0.2	High
Version	Manifest	Bundle-Version	3.0.2	High
Version	pom	version	3.0.2	Highest

Identifiers

pkg:maven/com.google.code.findbugs/jsr305@3.0.2 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.36\lombok-1.18.36.jar\lombok\launch\mavenEcjBootstrapAgent.jar
MD5: 27467519bf9615b24cad3b003c4353a9
SHA1: 37d92e0a726a67883ab94bee27c6f292e6318dcd
SHA256:9566d0706d6245cac3cdd9db6d1d81551aa3e727febcf64452c6db9701c40037
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mavenEcjBootstrapAgent	High
Vendor	jar	package name	launch	Low
Vendor	jar	package name	lombok	Low
Vendor	Manifest	can-redefine-classes	true	Low
Product	file	name	mavenEcjBootstrapAgent	High
Product	jar	package name	launch	Low
Product	Manifest	can-redefine-classes	true	Low

Identifiers

None

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: https://projectlombok.org/LICENSE

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.36\lombok-1.18.36.jar
MD5: 92c08153ae16c161c8cc2cc8185d2724
SHA1: 5a30490a6e14977d97d9c73c924c1f1b5311ea95
SHA256:73b6b05b6a2d365b700bab08d30f94de9d336490bc0acce5b6181fef48cbf18e
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.102

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	lombok	High
Vendor	jar	package name	java	Highest
Vendor	jar	package name	lombok	Highest
Vendor	jar	package name	tostring	Highest
Vendor	Manifest	automatic-module-name	lombok	Medium
Vendor	Manifest	can-redefine-classes	true	Low
Vendor	pom	artifactid	lombok	Highest
Vendor	pom	artifactid	lombok	Low
Vendor	pom	developer email	reinier@projectlombok.org	Low
Vendor	pom	developer email	roel@projectlombok.org	Low
Vendor	pom	developer id	rspilker	Medium
Vendor	pom	developer id	rzwitserloot	Medium
Vendor	pom	developer name	Reinier Zwitserloot	Medium
Vendor	pom	developer name	Roel Spilker	Medium
Vendor	pom	groupid	org.projectlombok	Highest
Vendor	pom	name	Project Lombok	High
Vendor	pom	url	https://projectlombok.org	Highest
Product	file	name	lombok	High
Product	jar	package name	java	Highest
Product	jar	package name	lombok	Highest
Product	jar	package name	tostring	Highest
Product	Manifest	automatic-module-name	lombok	Medium
Product	Manifest	can-redefine-classes	true	Low
Product	pom	artifactid	lombok	Highest
Product	pom	developer email	reinier@projectlombok.org	Low
Product	pom	developer email	roel@projectlombok.org	Low
Product	pom	developer id	rspilker	Low
Product	pom	developer id	rzwitserloot	Low
Product	pom	developer name	Reinier Zwitserloot	Low
Product	pom	developer name	Roel Spilker	Low
Product	pom	groupid	org.projectlombok	Highest
Product	pom	name	Project Lombok	High
Product	pom	url	https://projectlombok.org	Medium
Version	file	version	1.18.36	High
Version	Manifest	lombok-version	1.18.36	Medium
Version	pom	version	1.18.36	Highest

Identifiers

pkg:maven/org.projectlombok/lombok@1.18.36 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\gaul\modernizer-maven-annotations\3.1.0\modernizer-maven-annotations-3.1.0.jar
MD5: b188aef3e94d39c7e7a8ebb6b740559f
SHA1: 06eeda8c72054cfccf610ae772f606dbd13acf32
SHA256:1b4e8adc970715721846afeb632edd1c9dc9c07dc052b691c0c8d899c9b9f017
Referenced In Project/Scope: tomcat9-config:provided
modernizer-maven-annotations-3.1.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.102

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	modernizer-maven-annotations	High
Vendor	jar	package name	gaul	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	modernizer-maven-annotations	Highest
Vendor	pom	artifactid	modernizer-maven-annotations	Low
Vendor	pom	groupid	org.gaul	Highest
Vendor	pom	name	Modernizer Maven Plugin annotations	High
Vendor	pom	parent-artifactid	modernizer-maven-parent	Low
Product	file	name	modernizer-maven-annotations	High
Product	jar	package name	gaul	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	modernizer-maven-annotations	Highest
Product	pom	groupid	org.gaul	Highest
Product	pom	name	Modernizer Maven Plugin annotations	High
Product	pom	parent-artifactid	modernizer-maven-parent	Medium
Version	file	version	3.1.0	High
Version	pom	version	3.1.0	Highest

Identifiers

pkg:maven/org.gaul/modernizer-maven-annotations@3.1.0 (Confidence:High)

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html

File Path: C:\Users\Jeremy\.m2\repository\com\github\spotbugs\spotbugs-annotations\4.9.1\spotbugs-annotations-4.9.1.jar
MD5: 175c0ef6f2dafbc14f6b7adafd77bff4
SHA1: aabc37796156fba4580f7c47212d6bef992380f2
SHA256:7ff76e691441580bc26589eaf1c3be18a8c01a593e32bcce257c44491c2a61cc
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.102

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spotbugs-annotations	High
Vendor	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Vendor	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Vendor	pom	artifactid	spotbugs-annotations	Highest
Vendor	pom	artifactid	spotbugs-annotations	Low
Vendor	pom	developer email	andreas.sewe@codetrails.com	Low
Vendor	pom	developer email	dbrosius@mebigfatguy.com	Low
Vendor	pom	developer email	loskutov@gmx.de	Low
Vendor	pom	developer email	skypencil@gmail.com	Low
Vendor	pom	developer id	henrik242	Medium
Vendor	pom	developer id	iloveeclipse	Medium
Vendor	pom	developer id	jsotuyod	Medium
Vendor	pom	developer id	KengoTODA	Medium
Vendor	pom	developer id	mebigfatguy	Medium
Vendor	pom	developer id	sewe	Medium
Vendor	pom	developer id	ThrawnCA	Medium
Vendor	pom	developer name	Andreas Sewe	Medium
Vendor	pom	developer name	Andrey Loskutov	Medium
Vendor	pom	developer name	Dave Brosius	Medium
Vendor	pom	developer name	Juan Martín Sotuyo Dodero	Medium
Vendor	pom	developer name	Kengo TODA	Medium
Vendor	pom	groupid	com.github.spotbugs	Highest
Vendor	pom	name	SpotBugs Annotations	High
Vendor	pom	url	https://spotbugs.github.io/	Highest
Product	file	name	spotbugs-annotations	High
Product	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Product	Manifest	Bundle-Name	spotbugs-annotations	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Product	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Product	pom	artifactid	spotbugs-annotations	Highest
Product	pom	developer email	andreas.sewe@codetrails.com	Low
Product	pom	developer email	dbrosius@mebigfatguy.com	Low
Product	pom	developer email	loskutov@gmx.de	Low
Product	pom	developer email	skypencil@gmail.com	Low
Product	pom	developer id	henrik242	Low
Product	pom	developer id	iloveeclipse	Low
Product	pom	developer id	jsotuyod	Low
Product	pom	developer id	KengoTODA	Low
Product	pom	developer id	mebigfatguy	Low
Product	pom	developer id	sewe	Low
Product	pom	developer id	ThrawnCA	Low
Product	pom	developer name	Andreas Sewe	Low
Product	pom	developer name	Andrey Loskutov	Low
Product	pom	developer name	Dave Brosius	Low
Product	pom	developer name	Juan Martín Sotuyo Dodero	Low
Product	pom	developer name	Kengo TODA	Low
Product	pom	groupid	com.github.spotbugs	Highest
Product	pom	name	SpotBugs Annotations	High
Product	pom	url	https://spotbugs.github.io/	Medium
Version	file	version	4.9.1	High
Version	Manifest	Bundle-Version	4.9.1	High
Version	pom	version	4.9.1	Highest

Identifiers

pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.1 (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\annotations-api.jar
MD5: c68d434086ffd6d273cf24b48f10e05f
SHA1: 3aa6c33c386d649763838b2f0f7ef20e3e27e80b
SHA256:e239f52826d8ac47e2eb9213e96b96a927997554c2c0bc1d7719471c3cdf88f8
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	annotations-api	High
Vendor	jar	package name	annotation	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Vendor	manifest: javax/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/security/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/sql/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	annotations-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	annotation	Low
Product	jar	package name	javax	Highest
Product	jar	package name	security	Highest
Product	jar	package name	sql	Highest
Product	Manifest	Bundle-Name	tomcat-annotations-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Product	manifest: javax/annotation/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/security/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/security/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/sql/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/sql/	Specification-Title	Common Annotations	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	security	Highest
Version	jar	package name	sql	Highest
Version	Manifest	Bundle-Version	9.0.102	High
Version	manifest: javax/annotation/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/security/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/sql/	Implementation-Version	1.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\bin\bootstrap.jar
MD5: 38ba65f8c0258859d419518de43d28c8
SHA1: 250a5e0878298dc1d451581c7ff6fcc776f074ef
SHA256:8a1e49b06f4ac881449c1407bc917a07e5159d343dc1097c45ff732bb2d212b6
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	bootstrap	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	startup	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	bootstrap	High
Product	jar	package name	apache	Highest
Product	jar	package name	bootstrap	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	startup	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Implementation-Title	Apache Tomcat Bootstrap	High
Product	Manifest	specification-title	Apache Tomcat Bootstrap	Medium
Version	Manifest	Implementation-Version	9.0.102	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\catalina-ant.jar
MD5: 5316f7d6c3093d61a2c60bf97f9339c2
SHA1: ef81ce7932db2233cf030c07de75d26f4875a82a
SHA256:07f4d08bf23b31a24a21f54120208cf86d9ad7926537f0abea4b24606a29c1b6
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ant	High
Vendor	jar	package name	ant	Low
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ant	High
Product	jar	package name	ant	Low
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Low
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Implementation-Version	9.0.102	High

Identifiers

cpe:2.3:a:apache:ant:9.0.102:*:*:*:*:*:*:* (Confidence:High)
cpe:2.3:a:apache:tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\catalina-ha.jar
MD5: e5a4f57a57d3adf230cad0df701cf451
SHA1: e644a7757cf1f90b314716a42a7bd7fb5e189c5a
SHA256:bfc84addd2a6837148cbb47883515381600f060f2839993255da60090c245c0c
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ha	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	ha	Highest
Vendor	jar	package name	ha	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ha	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	ha	Highest
Product	jar	package name	ha	Low
Product	Manifest	Bundle-Name	tomcat-catalina-ha	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.102	High
Version	Manifest	Implementation-Version	9.0.102	High

Related Dependencies

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\catalina.jar
MD5: 345d67e68f0496f1052ce1000c40fa03
SHA1: 9b0a481079268701b3a2486747b49dbe85624d10
SHA256:916918bf266b22c80c6698707f5e577f775bbb6ea84952ee7e6f438741af2a0b
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-catalina	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.102	High
Version	Manifest	Implementation-Version	9.0.102	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Highest)

Description:

    Apache Commons Daemon software is a set of utilities and Java support
    classes for running Java applications as server processes. These are
    commonly known as 'daemon' processes in Unix terminology (hence the
    name). On Windows they are called 'services'.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\bin\commons-daemon.jar
MD5: 00d973e42c1620f71f81e6c78d02fa2d
SHA1: 8308391bc284f7890139b58272819480594135fb
SHA256:fd306f20fbe9ab60c2e06a8b8bdda786d8d2e1a10bfe475cde89f1b7864f4e7e
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-daemon	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	daemon	Highest
Vendor	jar	package name	support	Highest
Vendor	Manifest	build-jdk-spec	23	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.apache	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-daemon	Low
Vendor	pom	developer email	billbarker at apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	jfclere at apache.org	Low
Vendor	pom	developer email	mturk at apache.org	Low
Vendor	pom	developer email	pier at apache.org	Low
Vendor	pom	developer email	remm at apache.org	Low
Vendor	pom	developer email	yoavs at apache.org	Low
Vendor	pom	developer id	billbarker	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	jfclere	Medium
Vendor	pom	developer id	mturk	Medium
Vendor	pom	developer id	pier	Medium
Vendor	pom	developer id	remm	Medium
Vendor	pom	developer id	yoavs	Medium
Vendor	pom	developer name	Bill Barker	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Jean-Frederic Clere	Medium
Vendor	pom	developer name	Mladen Turk	Medium
Vendor	pom	developer name	Pier Fumagalli	Medium
Vendor	pom	developer name	Remy Maucherat	Medium
Vendor	pom	developer name	Yoav Shapira	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-daemon	Highest
Vendor	pom	name	Apache Commons Daemon	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-daemon/	Highest
Product	file	name	commons-daemon	High
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	daemon	Highest
Product	jar	package name	support	Highest
Product	Manifest	build-jdk-spec	23	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Product	Manifest	Bundle-Name	Apache Commons Daemon	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Product	Manifest	Implementation-Title	Apache Commons Daemon	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons Daemon	Medium
Product	pom	artifactid	commons-daemon	Highest
Product	pom	developer email	billbarker at apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	jfclere at apache.org	Low
Product	pom	developer email	mturk at apache.org	Low
Product	pom	developer email	pier at apache.org	Low
Product	pom	developer email	remm at apache.org	Low
Product	pom	developer email	yoavs at apache.org	Low
Product	pom	developer id	billbarker	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	jfclere	Low
Product	pom	developer id	mturk	Low
Product	pom	developer id	pier	Low
Product	pom	developer id	remm	Low
Product	pom	developer id	yoavs	Low
Product	pom	developer name	Bill Barker	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Jean-Frederic Clere	Low
Product	pom	developer name	Mladen Turk	Low
Product	pom	developer name	Pier Fumagalli	Low
Product	pom	developer name	Remy Maucherat	Low
Product	pom	developer name	Yoav Shapira	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-daemon	Highest
Product	pom	name	Apache Commons Daemon	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-daemon/	Medium
Version	Manifest	Bundle-Version	1.4.1	High
Version	Manifest	Implementation-Version	1.4.1	High
Version	pom	parent-version	1.4.1	Low
Version	pom	version	1.4.1	Highest

Identifiers

pkg:maven/commons-daemon/commons-daemon@1.4.1 (Confidence:High)
cpe:2.3:a:apache:apache_commons_daemon:1.4.1:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\ecj-4.20.jar
MD5: ee47966a67cd4019f1b8ccac74ba8dca
SHA1: 4837be609a3368a0f7e7cf0dc1bdbc7fe94993de
SHA256:ac0ba5876eaf7ebb47749a0d1be179c51f194b9dd0b875d1c09e1b530f5a2db5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	ecj	High
Vendor	jar	package name	compiler	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	eclipse	Low
Vendor	jar	package name	internal	Low
Vendor	jar	package name	jdt	Highest
Vendor	jar	package name	jdt	Low
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Product	file	name	ecj	High
Product	jar	package name	compiler	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	core	Highest
Product	jar	package name	eclipse	Highest
Product	jar	package name	internal	Low
Product	jar	package name	jdt	Highest
Product	jar	package name	jdt	Low
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	Eclipse Compiler for Java(TM)	Medium
Product	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Version	file	name	ecj	Medium
Version	file	version	4.20	High
Version	Manifest	build-jdk-spec	11	Low
Version	Manifest	Bundle-Version	3.26.0.v20210609-0549	High

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\el-api.jar
MD5: b51256c361ea76f97a53c734c8e7ce24
SHA1: 48c10c67c3aabaaa5d0db15c5a87d95f06ed6e14
SHA256:19a0c63ad4858875ee58fca509d05bcb061b8b7d76f9e626e337a791702b41f0
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Vendor	manifest: javax/el/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expression	Highest
Product	jar	package name	javax	Highest
Product	Manifest	Bundle-Name	tomcat-el-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Product	manifest: javax/el/	Implementation-Title	javax.el	Medium
Product	manifest: javax/el/	Specification-Title	Expression Language	Medium
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.102	High
Version	manifest: javax/el/	Implementation-Version	3.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-0493

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST
cve@mitre.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0044

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2000-0760

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2000-0672

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

CVE-2000-1210

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

CVE-2001-0590

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0042

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0043

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0045

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-0808

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\jasper-el.jar
MD5: 7c86c5bc958d75eed0a1c8b220531a66
SHA1: 5ce7274bfd8030d9347bd726a5b0ed8158cf4cf2
SHA256:f7efa3e6fd734d8ce08fa10c73a7376a361ef0c5f8d8bb563160526e52f698fd
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	parser	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expressionfactoryimpl	Highest
Product	jar	package name	parser	Low
Product	Manifest	Bundle-Name	tomcat-jasper-el	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	jar	package name	apache	Highest
Version	jar	package name	el	Highest
Version	jar	package name	expressionfactoryimpl	Highest
Version	Manifest	Bundle-Version	9.0.102	High
Version	Manifest	Implementation-Version	9.0.102	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\jasper.jar
MD5: 1fed3b4872e0cca8b07d9361ace226f4
SHA1: 85d9f7816499480408752b7da317d6ad2f7eb2e8
SHA256:eff68f2b9b52648edd5f56e34462a0602790a0a475763ffd430c2ddb126a3e03
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	compiler	Low
Vendor	jar	package name	jasper	Highest
Vendor	jar	package name	jasper	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper	High
Product	jar	package name	apache	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	jasper	Highest
Product	jar	package name	jasper	Low
Product	Manifest	Bundle-Name	tomcat-jasper	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.102	High
Version	Manifest	Implementation-Version	9.0.102	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\jaspic-api.jar
MD5: b65c73e94aaaba39776228c39e9603d7
SHA1: 077369f9bbfb2bdf2838a001b4639d1fd18a1710
SHA256:dfe44f30c20b50b78b3ad63f357b0edf8a6556323f473eb337fa8b428d96812a
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jaspic-api	High
Vendor	jar	package name	auth	Low
Vendor	jar	package name	javax	Low
Vendor	jar	package name	security	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Vendor	manifest: javax/security/auth/message/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/callback/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/config/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/module/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jaspic-api	High
Product	jar	package name	auth	Highest
Product	jar	package name	auth	Low
Product	jar	package name	javax	Highest
Product	jar	package name	message	Highest
Product	jar	package name	message	Low
Product	jar	package name	security	Highest
Product	jar	package name	security	Low
Product	Manifest	Bundle-Name	tomcat-jaspic-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Product	manifest: javax/security/auth/message/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/callback/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/callback/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/config/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/config/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/module/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/module/	Specification-Title	Java Authentication SPI for Containers	Medium
Version	jar	package name	auth	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	message	Highest
Version	jar	package name	security	Highest
Version	Manifest	Bundle-Version	9.0.102	High
Version	manifest: javax/security/auth/message/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/callback/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/config/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/module/	Implementation-Version	1.1.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\jsp-api.jar
MD5: 1693b007c6e9857d277dc31309568f20
SHA1: a336b416ece5e34cafaebea96d6d304b1c9743d1
SHA256:ecfae7b6ec347bf74fc0d5e616ad48b6e87c8fb24efb547225f4e268556e0558
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsp-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	jsp	Low
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Vendor	manifest: javax/servlet/jsp/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/tagext/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jsp-api	High
Product	jar	package name	el	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	jsp	Low
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	jar	package name	tagext	Highest
Product	Manifest	Bundle-Name	tomcat-jsp-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Product	manifest: javax/servlet/jsp/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/el/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/el/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/resources/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/resources/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/tagext/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/tagext/	Specification-Title	Java API for JavaServer Pages	Medium
Version	jar	package name	el	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	servlet	Highest
Version	jar	package name	tagext	Highest
Version	Manifest	Bundle-Version	9.0.102	High
Version	manifest: javax/servlet/jsp/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/el/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/resources/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/tagext/	Implementation-Version	2.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\webapps\docs\appdev\sample\sample.war
MD5: 570f196c4a1025a717269d16d11d6f37
SHA1: 80f5053b166c69d81697ba21113c673f8372aca0
SHA256:89b33caa5bf4cfd235f060c396cb1a5acb2734a1366db325676f48c5f5ed92e5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	sample	High
Vendor	jar	package name	classes	Low
Vendor	jar	package name	mypackage	Low
Vendor	jar	package name	web-inf	Low
Product	file	name	sample	High
Product	jar	package name	classes	Low
Product	jar	package name	hello	Low
Product	jar	package name	mypackage	Low

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\servlet-api.jar
MD5: 0af0416c963354a0f22ba6d1756dcceb
SHA1: 2b77d720fa672a3870d2773cbc2900a5fdd62751
SHA256:87390ea92a9997d60c7cd4c69fcb2406ac238e32e64080474b652c08fb2cf3bd
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	servlet-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	servlet	Highest
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Vendor	manifest: javax/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	servlet-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	Manifest	Bundle-Name	tomcat-servlet-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Product	manifest: javax/servlet/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/annotation/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/annotation/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/descriptor/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/descriptor/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/http/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/http/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/resources/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/resources/	Specification-Title	Java API for Servlets	Medium
Version	jar	package name	annotation	Highest
Version	jar	package name	descriptor	Highest
Version	jar	package name	http	Highest
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.102	High
Version	manifest: javax/servlet/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/annotation/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/descriptor/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/http/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/resources/	Implementation-Version	4.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2272

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSSv2:

Base Score: HIGH (7.8)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
cve@mitre.org - EXPLOIT,PATCH
cve@mitre.org - PATCH

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

NVD-CWE-Other

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0866

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-1355

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
secalert@redhat.com - EXPLOIT,PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-3383

Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,US_GOVERNMENT_RESOURCE
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - TOOL_SIGNATURE
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - TOOL_SIGNATURE
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-2450

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-5461

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
secalert@redhat.com - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-5519

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - EXPLOIT,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

        An implementation of the JSP Standard Tag Library (JSTL).

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\webapps\examples\WEB-INF\lib\taglibs-standard-impl-1.2.5.jar
MD5: 8e5c8db242fbef3db1acfcbb3bc8ec8b
SHA1: 9b9783ccb2a323383e6e20e36d368f8997b71967
SHA256:d075cb77d94e2d115b4d90a897b57d65cc31ed8e1b95d65361da324642705728
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	taglibs-standard-impl	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	standard	Highest
Vendor	jar	package name	tag	Highest
Vendor	jar	package name	taglibs	Highest
Vendor	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Vendor	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Vendor	pom	artifactid	taglibs-standard-impl	Low
Vendor	pom	developer name	Bjorn Townsend	Medium
Vendor	pom	developer name	Dmitri Plotnikov	Medium
Vendor	pom	developer name	Felipe Leme	Medium
Vendor	pom	developer name	Glenn Nielsen	Medium
Vendor	pom	developer name	Hans Bergsten	Medium
Vendor	pom	developer name	Henri Yandell	Medium
Vendor	pom	developer name	Jan Luehe	Medium
Vendor	pom	developer name	Justyna Horwat	Medium
Vendor	pom	developer name	Mark Kolb	Medium
Vendor	pom	developer name	Nathan Abramson	Medium
Vendor	pom	developer name	Pierre Delisle	Medium
Vendor	pom	developer name	Scott Hasse	Medium
Vendor	pom	developer name	Shawn Bayern	Medium
Vendor	pom	groupid	org.apache.taglibs	Highest
Vendor	pom	name	Apache Standard Taglib Implementation	High
Vendor	pom	parent-artifactid	taglibs-standard	Low
Product	file	name	taglibs-standard-impl	High
Product	jar	package name	apache	Highest
Product	jar	package name	standard	Highest
Product	jar	package name	tag	Highest
Product	jar	package name	taglibs	Highest
Product	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Product	Manifest	Bundle-Name	Apache Standard Taglib Implementation	Medium
Product	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Product	Manifest	Implementation-Title	Apache Standard Taglib Implementation	High
Product	pom	artifactid	taglibs-standard-impl	Highest
Product	pom	developer name	Bjorn Townsend	Low
Product	pom	developer name	Dmitri Plotnikov	Low
Product	pom	developer name	Felipe Leme	Low
Product	pom	developer name	Glenn Nielsen	Low
Product	pom	developer name	Hans Bergsten	Low
Product	pom	developer name	Henri Yandell	Low
Product	pom	developer name	Jan Luehe	Low
Product	pom	developer name	Justyna Horwat	Low
Product	pom	developer name	Mark Kolb	Low
Product	pom	developer name	Nathan Abramson	Low
Product	pom	developer name	Pierre Delisle	Low
Product	pom	developer name	Scott Hasse	Low
Product	pom	developer name	Shawn Bayern	Low
Product	pom	groupid	org.apache.taglibs	Highest
Product	pom	name	Apache Standard Taglib Implementation	High
Product	pom	parent-artifactid	taglibs-standard	Medium
Version	file	version	1.2.5	High
Version	Manifest	Bundle-Version	1.2.5	High
Version	Manifest	Implementation-Version	1.2.5	High
Version	pom	version	1.2.5	Highest

Related Dependencies

Identifiers

pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5 (Confidence:High)
cpe:2.3:a:apache:standard_taglibs:1.2.5:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-api.jar
MD5: 595f457610521dc3c20ac7e2b7c07467
SHA1: 4bf0bc67b9082bf4552daa7d688c5f7aa166c38e
SHA256:fa9fd552ee6eb9101898e18fa7fc077307c4c4663f31c9c10dca18272aa2c9bb
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-api	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	tomcat	Highest
Vendor	jar	package name	tomcat	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-api	High
Product	jar	package name	apache	Highest
Product	jar	package name	tomcat	Highest
Product	jar	package name	tomcat	Low
Product	Manifest	Bundle-Name	tomcat-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.102	High
Version	Manifest	Implementation-Version	9.0.102	High

Related Dependencies

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-coyote-ffm.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-coyote-ffm.jar
- MD5: b3e2a2c9d100cfb4d4c84ede177b96d7
- SHA1: a8c848515197f27b447c3f9fc80ef02d4290da83
- SHA256: 49279c814baaca714ca109aeba660e3f6d9b4f8c1c637fee6130930a886c6503
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-coyote.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-coyote.jar
- MD5: 30b9255adddc603e97f47ece460d8b84
- SHA1: 14b11a1ff302219d50c3936baf29c5f7435b81ee
- SHA256: 83175979996cf79ab40b52b828ab63d43be7a013d5ffaba5844461ea5faf038f
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-dbcp.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-dbcp.jar
- MD5: c5fb98296a9de051cf81f8714542f466
- SHA1: 0d896f405adfec52c4790caf862a91d23da2f935
- SHA256: 031ab14b6918655d19b4a3477c4e9267eb57f00b791733c7d72fc7543e001e88
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-jdbc.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-jdbc.jar
- MD5: 8f3aa4c5aa90126d8c172b146ea81f6b
- SHA1: adfd36b5bd3294e33f540e14dfb9483045d63662
- SHA256: e083f289e8788ee2ae520d33f44dbd39417a8ff7631996be19576b396ad9ec2a
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-jni.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-jni.jar
- MD5: 22f09cf8acdf2ac918753c3b334311e5
- SHA1: fb570df8de09d3f66dedc4950daf7ec397d56e92
- SHA256: 8859383a4bcde2a9eb9a319cd0016d4dbf0b087a78f14cee53a57ef90fd09c6b
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-util-scan.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-util-scan.jar
- MD5: 07146fcdaaca68d60ca885dd8da00836
- SHA1: 81bf5779bc147e9187557a8e962ec1fd793abac7
- SHA256: e0da59e01ca28fdf8b736046193869836e8f170583e0b543356772c0f33e9b04
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-util.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-util.jar
- MD5: 047df072ff9ca8534f7e802150695ac1
- SHA1: 811d779533298257e33d9ab6008f4433222d604f
- SHA256: bdddb883e402d41a2d75b8d3120889d6d12e601a13ab063ee4381a7d73569f2b

Identifiers

cpe:2.3:a:apache:tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-i18n-cs.jar
MD5: 2eb56af5e72eb78c9302621d6386f136
SHA1: 7be693926049d410b550ad77d80c4a1a0401b9a9
SHA256:bcac742aeeef9ece10972ec5b7f00f7ce5d747ebae30928ab52c83665a961fda
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-cs	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-cs	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-cs	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.102	High

Related Dependencies

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-i18n-de.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-i18n-de.jar
- MD5: 6311de2d2f97f6fb2d3b1c1823fa344d
- SHA1: 38b3958ed2413e839495ae23bd0f53f37fac3d5c
- SHA256: 57c410c8253bc5c6f8ff0e4be22e28587fe8ca4c9cff96dd46ccb4920f4331ea
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-i18n-es.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-i18n-es.jar
- MD5: 0e8f277a6fe216d9aea5847e8050d732
- SHA1: ffa718d8d560f1b9c48fa4def6b87712ac455e11
- SHA256: c9a25a97b28caa6625f75aa5e3320302b0a347e4045be30f08a4f305d68f9950
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-i18n-ja.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-i18n-ja.jar
- MD5: 075bf010f6dcfec4acfc496d505a5e8d
- SHA1: 934ba559e68792a7220df93ca02a775f11074840
- SHA256: 5f8fa383bd0d05607a5116c7db1ddd4880a49cd8b37936351b7b2f95b60099ee
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-i18n-ko.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-i18n-ko.jar
- MD5: ad45046d2b4a6a012fe01b3130d6b64c
- SHA1: 04f9d5139cfe7b56cd5a57c70b2572731e1412bd
- SHA256: 201704f477661ff0b58375c8dcb5da2aff361c66a44d86613bd4adbb92bd3a68
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-i18n-pt-BR.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-i18n-pt-BR.jar
- MD5: bed7e7aea3c2cc4f5cee3eb39b40bc82
- SHA1: 4d338dd9769ecb8fe2d0af409c5a7b75ab9bcd84
- SHA256: 73d0701ee21117413749c284077f1a7e53540ca181d4759af034168f2d6df02e
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-i18n-ru.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-i18n-ru.jar
- MD5: 9936a2b07a7dd2a93f42aeae71a37271
- SHA1: caa319dca90f80c54cf13787c482a3b15fb496df
- SHA256: f3188d68877367b5e48eb194514efdc10126dc6f2c0e22fa22c75c3656f06960
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-i18n-zh-CN.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-i18n-zh-CN.jar
- MD5: 8ddbb70f41352ebf8d1c8d1a0677d3fb
- SHA1: a5bb5f40b67109e065cc5e720c45e8a7cea58c50
- SHA256: 6796c7ba6ad985dbaeb5e06b6f1fc18942a5e7c68f3e2815432c100feeab7ba7
tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-websocket.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-websocket.jar
- MD5: 066fdc925ab24534bd2bb029feae6bdd
- SHA1: 5d8725486ab9d5048c2bb95e3c51c13d8cae4ebe
- SHA256: 63789ee964ff65a7fb4a2d9b827c026eeeb939209f7c83b293ad1755d5b06843

Identifiers

cpe:2.3:a:apache:tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\tomcat-i18n-fr.jar
MD5: feae49d78399ecf0206684e3057a5764
SHA1: f5cad97c0e4f4e67566ed3c13233381ae91c5cbf
SHA256:ae6a4517bdbb5f4208b9dce85ba29515f1f8e14cf246a294732b758966ee2055
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-fr	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-fr	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-fr	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.102	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:nfr:nfr:9.0.102:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\bin\tomcat-juli.jar
MD5: d7b6daf88d7480477ecdb2cbaa5bab4f
SHA1: 6bfa38da1ea5e0b296b26bb669513159f97d4cfb
SHA256:a3f6778f97cd83cc93182495c50d986aaa91f33866f9653591d11ecb2e39069c
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-juli	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	juli	Highest
Vendor	jar	package name	juli	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-juli	High
Product	jar	package name	apache	Highest
Product	jar	package name	juli	Highest
Product	jar	package name	juli	Low
Product	Manifest	Bundle-Name	tomcat-juli	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.102	High
Version	Manifest	Implementation-Version	9.0.102	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.102:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.102\tomcat-9.0.102.tar.gz\tomcat-9.0.102.tar\apache-tomcat-9.0.102\lib\websocket-api.jar
MD5: 78365f5eaa00ff957d7fdf2d2c3c86eb
SHA1: a7f62c2d4650e00d40e756c8a1ea898d1268aa4f
SHA256:6d61e3e61340be3e9fc402ffdbdd85247760f0810890e0a2439cfebc90240c9e
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	websocket-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	websocket	Highest
Vendor	jar	package name	websocket	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Vendor	manifest: javax/websocket/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/websocket/server/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	websocket-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	server	Highest
Product	jar	package name	websocket	Highest
Product	jar	package name	websocket	Low
Product	Manifest	Bundle-Name	tomcat-websocket-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Product	manifest: javax/websocket/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/	Specification-Title	WebSocket	Medium
Product	manifest: javax/websocket/server/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/server/	Specification-Title	WebSocket	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	server	Highest
Version	Manifest	Bundle-Version	9.0.102	High
Version	manifest: javax/websocket/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/websocket/server/	Implementation-Version	1.1.FR	Medium

Identifiers

None

How to read the report | Suppressing false positives | Getting Help: github issues Sponsor

Project: tomcat9-config

com.github.hazendaz.tomcat:tomcat9-config:9.0.102

Summary

Dependencies (vulnerable)

checker-qual-3.49.0.jar

Evidence

Identifiers

error_prone_annotations-2.36.0.jar

Evidence

Identifiers

j2objc-annotations-3.0.0.jar

Evidence

Identifiers

jsr305-3.0.2.jar

Evidence

Identifiers

lombok-1.18.36.jar: mavenEcjBootstrapAgent.jar

Evidence

Identifiers

lombok-1.18.36.jar

Evidence

Identifiers

modernizer-maven-annotations-3.1.0.jar

Evidence

Identifiers

spotbugs-annotations-4.9.1.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: annotations-api.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: bootstrap.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: catalina-ant.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: catalina-ha.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: catalina.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: commons-daemon.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: ecj-4.20.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: el-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: jasper-el.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: jasper.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: jaspic-api.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: jsp-api.jar

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: sample.war

Evidence

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: servlet-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: taglibs-standard-impl-1.2.5.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.102.tar.gz: tomcat-9.0.102.tar: tomcat-api.jar

Evidence

How to read the report | Suppressing false positives | Getting Help: github issues

Sponsor