Dependency-Check Report

Dependency	Vulnerability IDs	Package	Highest Severity	CVE Count	Confidence	Evidence Count
checker-qual-3.49.3.jar		pkg:maven/org.checkerframework/checker-qual@3.49.3		0		44
error_prone_annotations-2.38.0.jar		pkg:maven/com.google.errorprone/error_prone_annotations@2.38.0		0		29
j2objc-annotations-3.0.0.jar		pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0		0		33
jsr305-3.0.2.jar		pkg:maven/com.google.code.findbugs/jsr305@3.0.2		0		17
lombok-1.18.38.jar: mavenEcjBootstrapAgent.jar				0		7
lombok-1.18.38.jar		pkg:maven/org.projectlombok/lombok@1.18.38		0		36
modernizer-maven-annotations-3.1.0.jar		pkg:maven/org.gaul/modernizer-maven-annotations@3.1.0		0		19
spotbugs-annotations-4.9.3.jar		pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.3		0		53
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: annotations-api.jar	cpe:2.3:a:apache:tomcat:9.0.107:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Low	30
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: bootstrap.jar	cpe:2.3:a:apache:tomcat:9.0.107:::::::*			0	Highest	16
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: catalina-ant.jar	cpe:2.3:a:apache:ant:9.0.107:::::::* cpe:2.3:a:apache:tomcat:9.0.107:::::::*			0	High	14
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: catalina-ha.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Highest	22
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: catalina.jar	cpe:2.3:a:apache:tomcat:9.0.107:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Highest	20
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: commons-daemon.jar	cpe:2.3:a:apache:apache_commons_daemon:1.4.1:::::::*	pkg:maven/commons-daemon/commons-daemon@1.4.1		0	Low	86
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: ecj-4.20.jar				0		25
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: el-api.jar	cpe:2.3:a:apache:tomcat:3.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*		CRITICAL*	31	Medium	20
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: jasper-el.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Low	26
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: jasper.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Highest	20
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: jaspic-api.jar	cpe:2.3:a:apache:tomcat:9.0.107:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Low	38
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: jsp-api.jar	cpe:2.3:a:apache:tomcat:9.0.107:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Low	39
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: sample.war				0		8
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: servlet-api.jar	cpe:2.3:a:apache:tomcat:4.0.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*		CRITICAL*	30	Medium	41
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: taglibs-standard-impl-1.2.5.jar	cpe:2.3:a:apache:standard_taglibs:1.2.5:::::::*	pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5		0	Highest	54
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-api.jar	cpe:2.3:a:apache:tomcat:9.0.107:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Highest	18
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-i18n-cs.jar	cpe:2.3:a:apache:tomcat:9.0.107:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Low	9
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-i18n-fr.jar	cpe:2.3:a:apache:tomcat:9.0.107:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::* cpe:2.3:a:nfr:nfr:9.0.107:::::::*			0	Low	9
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-juli.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:::::::*			0	Highest	18
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: websocket-api.jar				0		25

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: http://opensource.org/licenses/MIT

File Path: C:\Users\Jeremy\.m2\repository\org\checkerframework\checker-qual\3.49.3\checker-qual-3.49.3.jar
MD5: 5881721126d6f442ba085fcd81145a4d
SHA1: 119a4df4ba2e6a432b23989a785f81be38a56849
SHA256:367edbf2fe9f606c1fdb5a8ba6e1c9c27625993e1ff954e3868de70bcc6416b7
Referenced In Project/Scope: tomcat9-config:compile
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.107

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	checker-qual	High
Vendor	jar	package name	checker	Highest
Vendor	jar	package name	checkerframework	Highest
Vendor	jar	package name	framework	Highest
Vendor	jar	package name	qual	Highest
Vendor	Manifest	bundle-symbolicname	checker-qual	Medium
Vendor	Manifest	implementation-url	https://checkerframework.org	Low
Vendor	pom	artifactid	checker-qual	Highest
Vendor	pom	artifactid	checker-qual	Low
Vendor	pom	developer email	mernst@cs.washington.edu	Low
Vendor	pom	developer email	smillst@cs.washington.edu	Low
Vendor	pom	developer id	mernst	Medium
Vendor	pom	developer id	smillst	Medium
Vendor	pom	developer name	Michael Ernst	Medium
Vendor	pom	developer name	Suzanne Millstein	Medium
Vendor	pom	developer org	University of Washington	Medium
Vendor	pom	developer org URL	https://www.cs.washington.edu/	Medium
Vendor	pom	groupid	org.checkerframework	Highest
Vendor	pom	name	Checker Qual	High
Vendor	pom	url	https://checkerframework.org/	Highest
Product	file	name	checker-qual	High
Product	jar	package name	checker	Highest
Product	jar	package name	checkerframework	Highest
Product	jar	package name	framework	Highest
Product	jar	package name	qual	Highest
Product	Manifest	Bundle-Name	checker-qual	Medium
Product	Manifest	bundle-symbolicname	checker-qual	Medium
Product	Manifest	implementation-url	https://checkerframework.org	Low
Product	pom	artifactid	checker-qual	Highest
Product	pom	developer email	mernst@cs.washington.edu	Low
Product	pom	developer email	smillst@cs.washington.edu	Low
Product	pom	developer id	mernst	Low
Product	pom	developer id	smillst	Low
Product	pom	developer name	Michael Ernst	Low
Product	pom	developer name	Suzanne Millstein	Low
Product	pom	developer org	University of Washington	Low
Product	pom	developer org URL	https://www.cs.washington.edu/	Low
Product	pom	groupid	org.checkerframework	Highest
Product	pom	name	Checker Qual	High
Product	pom	url	https://checkerframework.org/	Medium
Version	file	version	3.49.3	High
Version	Manifest	Bundle-Version	3.49.3	High
Version	Manifest	Implementation-Version	3.49.3	High
Version	pom	version	3.49.3	Highest

Identifiers

pkg:maven/org.checkerframework/checker-qual@3.49.3 (Confidence:High)

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\errorprone\error_prone_annotations\2.38.0\error_prone_annotations-2.38.0.jar
MD5: 912f8206614000252841d89cb0461895
SHA1: fc0ae991433e8590ba51cd558421478318a74c8c
SHA256:6661d5335090a5fc61dd869d2095bc6c1e2156e3aa47a6e4ababdf64c99a7889
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.107

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	error_prone_annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	errorprone	Highest
Vendor	jar	package name	google	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Vendor	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	error_prone_annotations	Highest
Vendor	pom	artifactid	error_prone_annotations	Low
Vendor	pom	groupid	com.google.errorprone	Highest
Vendor	pom	name	error-prone annotations	High
Vendor	pom	parent-artifactid	error_prone_parent	Low
Product	file	name	error_prone_annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	errorprone	Highest
Product	jar	package name	google	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Product	Manifest	Bundle-Name	error-prone annotations	Medium
Product	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	error_prone_annotations	Highest
Product	pom	groupid	com.google.errorprone	Highest
Product	pom	name	error-prone annotations	High
Product	pom	parent-artifactid	error_prone_parent	Medium
Version	file	version	2.38.0	High
Version	Manifest	Bundle-Version	2.38.0	High
Version	pom	version	2.38.0	Highest

Identifiers

pkg:maven/com.google.errorprone/error_prone_annotations@2.38.0 (Confidence:High)

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\j2objc\j2objc-annotations\3.0.0\j2objc-annotations-3.0.0.jar
MD5: f59529b29202a5baf37f491ea5ec8627
SHA1: 7399e65dd7e9ff3404f4535b2f017093bdb134c7
SHA256:88241573467ddca44ffd4d74aa04c2bbfd11bf7c17e0c342c94c9de7a70a7c64
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.107

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	j2objc-annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	google	Highest
Vendor	jar	package name	j2objc	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	j2objc-annotations	Highest
Vendor	pom	artifactid	j2objc-annotations	Low
Vendor	pom	developer email	tball@google.com	Low
Vendor	pom	developer id	tomball	Medium
Vendor	pom	developer name	Tom Ball	Medium
Vendor	pom	developer org	Google	Medium
Vendor	pom	developer org URL	https://www.google.com	Medium
Vendor	pom	groupid	com.google.j2objc	Highest
Vendor	pom	name	J2ObjC Annotations	High
Vendor	pom	url	google/j2objc/	Highest
Product	file	name	j2objc-annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	google	Highest
Product	jar	package name	j2objc	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	j2objc-annotations	Highest
Product	pom	developer email	tball@google.com	Low
Product	pom	developer id	tomball	Low
Product	pom	developer name	Tom Ball	Low
Product	pom	developer org	Google	Low
Product	pom	developer org URL	https://www.google.com	Low
Product	pom	groupid	com.google.j2objc	Highest
Product	pom	name	J2ObjC Annotations	High
Product	pom	url	google/j2objc/	High
Version	file	version	3.0.0	High
Version	pom	version	3.0.0	Highest

Identifiers

pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0 (Confidence:High)

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\code\findbugs\jsr305\3.0.2\jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.3

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsr305	High
Vendor	Manifest	bundle-symbolicname	org.jsr-305	Medium
Vendor	pom	artifactid	jsr305	Highest
Vendor	pom	artifactid	jsr305	Low
Vendor	pom	groupid	com.google.code.findbugs	Highest
Vendor	pom	name	FindBugs-jsr305	High
Vendor	pom	url	http://findbugs.sourceforge.net/	Highest
Product	file	name	jsr305	High
Product	Manifest	Bundle-Name	FindBugs-jsr305	Medium
Product	Manifest	bundle-symbolicname	org.jsr-305	Medium
Product	pom	artifactid	jsr305	Highest
Product	pom	groupid	com.google.code.findbugs	Highest
Product	pom	name	FindBugs-jsr305	High
Product	pom	url	http://findbugs.sourceforge.net/	Medium
Version	file	version	3.0.2	High
Version	Manifest	Bundle-Version	3.0.2	High
Version	pom	version	3.0.2	Highest

Identifiers

pkg:maven/com.google.code.findbugs/jsr305@3.0.2 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.38\lombok-1.18.38.jar\lombok\launch\mavenEcjBootstrapAgent.jar
MD5: 885d5d6be90a5dcd4b82cdf741e3f31a
SHA1: e1f7f1779f40157fd0b984c1bc32a0cb45cae66e
SHA256:74a80a6ee84e5c6fe497dfcc46a46dbe30578525e747eb531e918ee0750c8da9
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mavenEcjBootstrapAgent	High
Vendor	jar	package name	launch	Low
Vendor	jar	package name	lombok	Low
Vendor	Manifest	can-redefine-classes	true	Low
Product	file	name	mavenEcjBootstrapAgent	High
Product	jar	package name	launch	Low
Product	Manifest	can-redefine-classes	true	Low

Identifiers

None

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: https://projectlombok.org/LICENSE

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.38\lombok-1.18.38.jar
MD5: 789cacd8d3969e9d23e6e6baec747f70
SHA1: 57f8f5e02e92a30fd21b80cbd426a4172b5f8e29
SHA256:1e1e427c36ff63c44fd30ef292d9e773ea3154460ab6265d3fed7e6f5bc50fb9
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.107

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	lombok	High
Vendor	jar	package name	java	Highest
Vendor	jar	package name	lombok	Highest
Vendor	jar	package name	tostring	Highest
Vendor	Manifest	automatic-module-name	lombok	Medium
Vendor	Manifest	can-redefine-classes	true	Low
Vendor	pom	artifactid	lombok	Highest
Vendor	pom	artifactid	lombok	Low
Vendor	pom	developer email	reinier@projectlombok.org	Low
Vendor	pom	developer email	roel@projectlombok.org	Low
Vendor	pom	developer id	rspilker	Medium
Vendor	pom	developer id	rzwitserloot	Medium
Vendor	pom	developer name	Reinier Zwitserloot	Medium
Vendor	pom	developer name	Roel Spilker	Medium
Vendor	pom	groupid	org.projectlombok	Highest
Vendor	pom	name	Project Lombok	High
Vendor	pom	url	https://projectlombok.org	Highest
Product	file	name	lombok	High
Product	jar	package name	java	Highest
Product	jar	package name	lombok	Highest
Product	jar	package name	tostring	Highest
Product	Manifest	automatic-module-name	lombok	Medium
Product	Manifest	can-redefine-classes	true	Low
Product	pom	artifactid	lombok	Highest
Product	pom	developer email	reinier@projectlombok.org	Low
Product	pom	developer email	roel@projectlombok.org	Low
Product	pom	developer id	rspilker	Low
Product	pom	developer id	rzwitserloot	Low
Product	pom	developer name	Reinier Zwitserloot	Low
Product	pom	developer name	Roel Spilker	Low
Product	pom	groupid	org.projectlombok	Highest
Product	pom	name	Project Lombok	High
Product	pom	url	https://projectlombok.org	Medium
Version	file	version	1.18.38	High
Version	Manifest	lombok-version	1.18.38	Medium
Version	pom	version	1.18.38	Highest

Identifiers

pkg:maven/org.projectlombok/lombok@1.18.38 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\gaul\modernizer-maven-annotations\3.1.0\modernizer-maven-annotations-3.1.0.jar
MD5: b188aef3e94d39c7e7a8ebb6b740559f
SHA1: 06eeda8c72054cfccf610ae772f606dbd13acf32
SHA256:1b4e8adc970715721846afeb632edd1c9dc9c07dc052b691c0c8d899c9b9f017
Referenced In Project/Scope: tomcat9-config:provided
modernizer-maven-annotations-3.1.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.107

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	modernizer-maven-annotations	High
Vendor	jar	package name	gaul	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	modernizer-maven-annotations	Highest
Vendor	pom	artifactid	modernizer-maven-annotations	Low
Vendor	pom	groupid	org.gaul	Highest
Vendor	pom	name	Modernizer Maven Plugin annotations	High
Vendor	pom	parent-artifactid	modernizer-maven-parent	Low
Product	file	name	modernizer-maven-annotations	High
Product	jar	package name	gaul	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	modernizer-maven-annotations	Highest
Product	pom	groupid	org.gaul	Highest
Product	pom	name	Modernizer Maven Plugin annotations	High
Product	pom	parent-artifactid	modernizer-maven-parent	Medium
Version	file	version	3.1.0	High
Version	pom	version	3.1.0	Highest

Identifiers

pkg:maven/org.gaul/modernizer-maven-annotations@3.1.0 (Confidence:High)

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html

File Path: C:\Users\Jeremy\.m2\repository\com\github\spotbugs\spotbugs-annotations\4.9.3\spotbugs-annotations-4.9.3.jar
MD5: 6149845e438bd5a34ebaf81f8bc9e243
SHA1: 4d362bffcfdfd734999e94d7d98fde678aae71cf
SHA256:13532bfe2f45fcd491432221df72d9cd0efb8f987c9245e12befa192c8925ce3
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.107

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spotbugs-annotations	High
Vendor	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Vendor	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Vendor	pom	artifactid	spotbugs-annotations	Highest
Vendor	pom	artifactid	spotbugs-annotations	Low
Vendor	pom	developer email	andreas.sewe@codetrails.com	Low
Vendor	pom	developer email	dbrosius@mebigfatguy.com	Low
Vendor	pom	developer email	loskutov@gmx.de	Low
Vendor	pom	developer email	skypencil@gmail.com	Low
Vendor	pom	developer id	henrik242	Medium
Vendor	pom	developer id	iloveeclipse	Medium
Vendor	pom	developer id	jsotuyod	Medium
Vendor	pom	developer id	KengoTODA	Medium
Vendor	pom	developer id	mebigfatguy	Medium
Vendor	pom	developer id	sewe	Medium
Vendor	pom	developer id	ThrawnCA	Medium
Vendor	pom	developer name	Andreas Sewe	Medium
Vendor	pom	developer name	Andrey Loskutov	Medium
Vendor	pom	developer name	Dave Brosius	Medium
Vendor	pom	developer name	Juan Martín Sotuyo Dodero	Medium
Vendor	pom	developer name	Kengo TODA	Medium
Vendor	pom	groupid	com.github.spotbugs	Highest
Vendor	pom	name	SpotBugs Annotations	High
Vendor	pom	url	https://spotbugs.github.io/	Highest
Product	file	name	spotbugs-annotations	High
Product	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Product	Manifest	Bundle-Name	spotbugs-annotations	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Product	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Product	pom	artifactid	spotbugs-annotations	Highest
Product	pom	developer email	andreas.sewe@codetrails.com	Low
Product	pom	developer email	dbrosius@mebigfatguy.com	Low
Product	pom	developer email	loskutov@gmx.de	Low
Product	pom	developer email	skypencil@gmail.com	Low
Product	pom	developer id	henrik242	Low
Product	pom	developer id	iloveeclipse	Low
Product	pom	developer id	jsotuyod	Low
Product	pom	developer id	KengoTODA	Low
Product	pom	developer id	mebigfatguy	Low
Product	pom	developer id	sewe	Low
Product	pom	developer id	ThrawnCA	Low
Product	pom	developer name	Andreas Sewe	Low
Product	pom	developer name	Andrey Loskutov	Low
Product	pom	developer name	Dave Brosius	Low
Product	pom	developer name	Juan Martín Sotuyo Dodero	Low
Product	pom	developer name	Kengo TODA	Low
Product	pom	groupid	com.github.spotbugs	Highest
Product	pom	name	SpotBugs Annotations	High
Product	pom	url	https://spotbugs.github.io/	Medium
Version	file	version	4.9.3	High
Version	Manifest	Bundle-Version	4.9.3	High
Version	pom	version	4.9.3	Highest

Identifiers

pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.3 (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\annotations-api.jar
MD5: 994541d6036fcbf90999ee3d2498c723
SHA1: 858b4a3fa5cf0fa9e7588f81a0820d6ba1f8aded
SHA256:4a68ccbd63cd06da85d2024d1c812a4e09d7d3e13a4be227aab8afdfc6772c31
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	annotations-api	High
Vendor	jar	package name	annotation	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Vendor	manifest: javax/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/security/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/sql/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	annotations-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	annotation	Low
Product	jar	package name	javax	Highest
Product	jar	package name	security	Highest
Product	jar	package name	sql	Highest
Product	Manifest	Bundle-Name	tomcat-annotations-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Product	manifest: javax/annotation/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/security/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/security/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/sql/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/sql/	Specification-Title	Common Annotations	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	security	Highest
Version	jar	package name	sql	Highest
Version	Manifest	Bundle-Version	9.0.107	High
Version	manifest: javax/annotation/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/security/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/sql/	Implementation-Version	1.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\bin\bootstrap.jar
MD5: 2ecc9d6b8283f431a69df07a8ec5645e
SHA1: fbab461096846f87872ad53fa0950a6ebfbf2edc
SHA256:e47aa868d13b1b07154a0974ada0a53ee5950935ce1aac1660668d71f98d210c
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	bootstrap	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	startup	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	bootstrap	High
Product	jar	package name	apache	Highest
Product	jar	package name	bootstrap	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	startup	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Implementation-Title	Apache Tomcat Bootstrap	High
Product	Manifest	specification-title	Apache Tomcat Bootstrap	Medium
Version	Manifest	Implementation-Version	9.0.107	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\catalina-ant.jar
MD5: 2c90cda170cfb2f3a2504da77d4f930a
SHA1: 60ace7cc26b9ac6716d8a992d73ca8f4a6e5072b
SHA256:dde35c95ab458512a1de5459bbe72adb0e170ecc48f0b4aab70729f3c6fec7cf
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ant	High
Vendor	jar	package name	ant	Low
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ant	High
Product	jar	package name	ant	Low
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Low
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Implementation-Version	9.0.107	High

Identifiers

cpe:2.3:a:apache:ant:9.0.107:*:*:*:*:*:*:* (Confidence:High)
cpe:2.3:a:apache:tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\catalina-ha.jar
MD5: 9366721d86ca41541f02562bdda427a6
SHA1: c4fa81fc708969e31d748407f8e8681639dc9195
SHA256:da3b601287235d20fb2a7cb08de2c4537eb1d33fa74e7ea76887af35a60addde
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ha	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	ha	Highest
Vendor	jar	package name	ha	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ha	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	ha	Highest
Product	jar	package name	ha	Low
Product	Manifest	Bundle-Name	tomcat-catalina-ha	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.107	High
Version	Manifest	Implementation-Version	9.0.107	High

Related Dependencies

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\catalina.jar
MD5: e05215b43a41bfa3659cc7f5eec00439
SHA1: e07b705f850e0a1eeea9462c055db4970ad15545
SHA256:4f4c59b33cc37ec1fb554ae151b6f9ca714f51601f9ed965d0d4eda9143e987d
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-catalina	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.107	High
Version	Manifest	Implementation-Version	9.0.107	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Highest)

Description:

    Apache Commons Daemon software is a set of utilities and Java support
    classes for running Java applications as server processes. These are
    commonly known as 'daemon' processes in Unix terminology (hence the
    name). On Windows they are called 'services'.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\bin\commons-daemon.jar
MD5: 00d973e42c1620f71f81e6c78d02fa2d
SHA1: 8308391bc284f7890139b58272819480594135fb
SHA256:fd306f20fbe9ab60c2e06a8b8bdda786d8d2e1a10bfe475cde89f1b7864f4e7e
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-daemon	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	daemon	Highest
Vendor	jar	package name	support	Highest
Vendor	Manifest	build-jdk-spec	23	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.apache	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-daemon	Low
Vendor	pom	developer email	billbarker at apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	jfclere at apache.org	Low
Vendor	pom	developer email	mturk at apache.org	Low
Vendor	pom	developer email	pier at apache.org	Low
Vendor	pom	developer email	remm at apache.org	Low
Vendor	pom	developer email	yoavs at apache.org	Low
Vendor	pom	developer id	billbarker	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	jfclere	Medium
Vendor	pom	developer id	mturk	Medium
Vendor	pom	developer id	pier	Medium
Vendor	pom	developer id	remm	Medium
Vendor	pom	developer id	yoavs	Medium
Vendor	pom	developer name	Bill Barker	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Jean-Frederic Clere	Medium
Vendor	pom	developer name	Mladen Turk	Medium
Vendor	pom	developer name	Pier Fumagalli	Medium
Vendor	pom	developer name	Remy Maucherat	Medium
Vendor	pom	developer name	Yoav Shapira	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-daemon	Highest
Vendor	pom	name	Apache Commons Daemon	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-daemon/	Highest
Product	file	name	commons-daemon	High
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	daemon	Highest
Product	jar	package name	support	Highest
Product	Manifest	build-jdk-spec	23	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Product	Manifest	Bundle-Name	Apache Commons Daemon	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Product	Manifest	Implementation-Title	Apache Commons Daemon	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons Daemon	Medium
Product	pom	artifactid	commons-daemon	Highest
Product	pom	developer email	billbarker at apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	jfclere at apache.org	Low
Product	pom	developer email	mturk at apache.org	Low
Product	pom	developer email	pier at apache.org	Low
Product	pom	developer email	remm at apache.org	Low
Product	pom	developer email	yoavs at apache.org	Low
Product	pom	developer id	billbarker	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	jfclere	Low
Product	pom	developer id	mturk	Low
Product	pom	developer id	pier	Low
Product	pom	developer id	remm	Low
Product	pom	developer id	yoavs	Low
Product	pom	developer name	Bill Barker	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Jean-Frederic Clere	Low
Product	pom	developer name	Mladen Turk	Low
Product	pom	developer name	Pier Fumagalli	Low
Product	pom	developer name	Remy Maucherat	Low
Product	pom	developer name	Yoav Shapira	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-daemon	Highest
Product	pom	name	Apache Commons Daemon	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-daemon/	Medium
Version	Manifest	Bundle-Version	1.4.1	High
Version	Manifest	Implementation-Version	1.4.1	High
Version	pom	parent-version	1.4.1	Low
Version	pom	version	1.4.1	Highest

Identifiers

pkg:maven/commons-daemon/commons-daemon@1.4.1 (Confidence:High)
cpe:2.3:a:apache:apache_commons_daemon:1.4.1:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\ecj-4.20.jar
MD5: ee47966a67cd4019f1b8ccac74ba8dca
SHA1: 4837be609a3368a0f7e7cf0dc1bdbc7fe94993de
SHA256:ac0ba5876eaf7ebb47749a0d1be179c51f194b9dd0b875d1c09e1b530f5a2db5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	ecj	High
Vendor	jar	package name	compiler	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	eclipse	Low
Vendor	jar	package name	internal	Low
Vendor	jar	package name	jdt	Highest
Vendor	jar	package name	jdt	Low
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Product	file	name	ecj	High
Product	jar	package name	compiler	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	core	Highest
Product	jar	package name	eclipse	Highest
Product	jar	package name	internal	Low
Product	jar	package name	jdt	Highest
Product	jar	package name	jdt	Low
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	Eclipse Compiler for Java(TM)	Medium
Product	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Version	file	name	ecj	Medium
Version	file	version	4.20	High
Version	Manifest	build-jdk-spec	11	Low
Version	Manifest	Bundle-Version	3.26.0.v20210609-0549	High

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\el-api.jar
MD5: bf67807a14fe3af52cd79670380f2f67
SHA1: ad2094e343bafd6c315240e109b929a8d7b29ea9
SHA256:c3a1b37be9926bc5e113995a0ccc2db96bd521020dc0b2b548a0942194194ba0
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Vendor	manifest: javax/el/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expression	Highest
Product	jar	package name	javax	Highest
Product	Manifest	Bundle-Name	tomcat-el-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Product	manifest: javax/el/	Implementation-Title	javax.el	Medium
Product	manifest: javax/el/	Specification-Title	Expression Language	Medium
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.107	High
Version	manifest: javax/el/	Implementation-Version	3.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-0493

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST
cve@mitre.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0044

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2000-0760

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2000-0672

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

CVE-2000-1210

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

CVE-2001-0590

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0042

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0043

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0045

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-0808

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\jasper-el.jar
MD5: 1e023facb79957f660c9275d31f60ee1
SHA1: 802840692f295134577537c321f85cc74d110030
SHA256:3efa7931ee110d7e3af443abbe93eb58924613c79496621a3c501e380373fae5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	parser	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expressionfactoryimpl	Highest
Product	jar	package name	parser	Low
Product	Manifest	Bundle-Name	tomcat-jasper-el	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	jar	package name	apache	Highest
Version	jar	package name	el	Highest
Version	jar	package name	expressionfactoryimpl	Highest
Version	Manifest	Bundle-Version	9.0.107	High
Version	Manifest	Implementation-Version	9.0.107	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\jasper.jar
MD5: c40d44ced5dbefea7e6c228768d0e18d
SHA1: 5a9f4066f6d5418533e6d639ff69da4ce7e8fb8b
SHA256:ae545e316b4f4e33bdbcc169f5a564e8b1cb0e8e087a9ba469cc2680ce2a2077
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	compiler	Low
Vendor	jar	package name	jasper	Highest
Vendor	jar	package name	jasper	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper	High
Product	jar	package name	apache	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	jasper	Highest
Product	jar	package name	jasper	Low
Product	Manifest	Bundle-Name	tomcat-jasper	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.107	High
Version	Manifest	Implementation-Version	9.0.107	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\jaspic-api.jar
MD5: b3d01a079a0ca58aed03bbec1cb51c7f
SHA1: 482e67bef2301b6783d54c50ebf9d6c286d83eb1
SHA256:531817c544865246c93fffaf8f4366ee35a1698939da0ae8d3829ecd66993bbb
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jaspic-api	High
Vendor	jar	package name	auth	Low
Vendor	jar	package name	javax	Low
Vendor	jar	package name	security	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Vendor	manifest: javax/security/auth/message/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/callback/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/config/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/module/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jaspic-api	High
Product	jar	package name	auth	Highest
Product	jar	package name	auth	Low
Product	jar	package name	javax	Highest
Product	jar	package name	message	Highest
Product	jar	package name	message	Low
Product	jar	package name	security	Highest
Product	jar	package name	security	Low
Product	Manifest	Bundle-Name	tomcat-jaspic-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Product	manifest: javax/security/auth/message/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/callback/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/callback/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/config/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/config/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/module/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/module/	Specification-Title	Java Authentication SPI for Containers	Medium
Version	jar	package name	auth	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	message	Highest
Version	jar	package name	security	Highest
Version	Manifest	Bundle-Version	9.0.107	High
Version	manifest: javax/security/auth/message/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/callback/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/config/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/module/	Implementation-Version	1.1.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\jsp-api.jar
MD5: ed4d33878e6f7afa59fbce81a792af23
SHA1: 5c14b1feaf766c29f319ee9b61db8483c6050e4a
SHA256:e0cee394859c849c3afdef6507129fc2c9bcd9cd95a2b6871ca231b5bacdde94
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsp-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	jsp	Low
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Vendor	manifest: javax/servlet/jsp/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/tagext/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jsp-api	High
Product	jar	package name	el	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	jsp	Low
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	jar	package name	tagext	Highest
Product	Manifest	Bundle-Name	tomcat-jsp-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Product	manifest: javax/servlet/jsp/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/el/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/el/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/resources/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/resources/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/tagext/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/tagext/	Specification-Title	Java API for JavaServer Pages	Medium
Version	jar	package name	el	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	servlet	Highest
Version	jar	package name	tagext	Highest
Version	Manifest	Bundle-Version	9.0.107	High
Version	manifest: javax/servlet/jsp/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/el/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/resources/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/tagext/	Implementation-Version	2.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\webapps\docs\appdev\sample\sample.war
MD5: 570f196c4a1025a717269d16d11d6f37
SHA1: 80f5053b166c69d81697ba21113c673f8372aca0
SHA256:89b33caa5bf4cfd235f060c396cb1a5acb2734a1366db325676f48c5f5ed92e5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	sample	High
Vendor	jar	package name	classes	Low
Vendor	jar	package name	mypackage	Low
Vendor	jar	package name	web-inf	Low
Product	file	name	sample	High
Product	jar	package name	classes	Low
Product	jar	package name	hello	Low
Product	jar	package name	mypackage	Low

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\servlet-api.jar
MD5: ca93d14741b69f7208732432a09db8d3
SHA1: cec004d4fcae409cec074af772171747eda9cae5
SHA256:2cc0937d565531ffc3b79b1e11ff6560a1969bc83eb550245e98c18bcc192b64
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	servlet-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	servlet	Highest
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Vendor	manifest: javax/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	servlet-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	Manifest	Bundle-Name	tomcat-servlet-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Product	manifest: javax/servlet/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/annotation/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/annotation/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/descriptor/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/descriptor/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/http/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/http/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/resources/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/resources/	Specification-Title	Java API for Servlets	Medium
Version	jar	package name	annotation	Highest
Version	jar	package name	descriptor	Highest
Version	jar	package name	http	Highest
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.107	High
Version	manifest: javax/servlet/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/annotation/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/descriptor/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/http/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/resources/	Implementation-Version	4.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2272

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSSv2:

Base Score: HIGH (7.8)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
cve@mitre.org - EXPLOIT,PATCH
cve@mitre.org - PATCH

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

NVD-CWE-Other

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0866

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-1355

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
secalert@redhat.com - EXPLOIT,PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-3383

Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,US_GOVERNMENT_RESOURCE
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - TOOL_SIGNATURE
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - TOOL_SIGNATURE
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-2450

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-5461

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
secalert@redhat.com - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-5519

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - EXPLOIT,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

        An implementation of the JSP Standard Tag Library (JSTL).

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\webapps\examples\WEB-INF\lib\taglibs-standard-impl-1.2.5.jar
MD5: 8e5c8db242fbef3db1acfcbb3bc8ec8b
SHA1: 9b9783ccb2a323383e6e20e36d368f8997b71967
SHA256:d075cb77d94e2d115b4d90a897b57d65cc31ed8e1b95d65361da324642705728
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	taglibs-standard-impl	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	standard	Highest
Vendor	jar	package name	tag	Highest
Vendor	jar	package name	taglibs	Highest
Vendor	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Vendor	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Vendor	pom	artifactid	taglibs-standard-impl	Low
Vendor	pom	developer name	Bjorn Townsend	Medium
Vendor	pom	developer name	Dmitri Plotnikov	Medium
Vendor	pom	developer name	Felipe Leme	Medium
Vendor	pom	developer name	Glenn Nielsen	Medium
Vendor	pom	developer name	Hans Bergsten	Medium
Vendor	pom	developer name	Henri Yandell	Medium
Vendor	pom	developer name	Jan Luehe	Medium
Vendor	pom	developer name	Justyna Horwat	Medium
Vendor	pom	developer name	Mark Kolb	Medium
Vendor	pom	developer name	Nathan Abramson	Medium
Vendor	pom	developer name	Pierre Delisle	Medium
Vendor	pom	developer name	Scott Hasse	Medium
Vendor	pom	developer name	Shawn Bayern	Medium
Vendor	pom	groupid	org.apache.taglibs	Highest
Vendor	pom	name	Apache Standard Taglib Implementation	High
Vendor	pom	parent-artifactid	taglibs-standard	Low
Product	file	name	taglibs-standard-impl	High
Product	jar	package name	apache	Highest
Product	jar	package name	standard	Highest
Product	jar	package name	tag	Highest
Product	jar	package name	taglibs	Highest
Product	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Product	Manifest	Bundle-Name	Apache Standard Taglib Implementation	Medium
Product	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Product	Manifest	Implementation-Title	Apache Standard Taglib Implementation	High
Product	pom	artifactid	taglibs-standard-impl	Highest
Product	pom	developer name	Bjorn Townsend	Low
Product	pom	developer name	Dmitri Plotnikov	Low
Product	pom	developer name	Felipe Leme	Low
Product	pom	developer name	Glenn Nielsen	Low
Product	pom	developer name	Hans Bergsten	Low
Product	pom	developer name	Henri Yandell	Low
Product	pom	developer name	Jan Luehe	Low
Product	pom	developer name	Justyna Horwat	Low
Product	pom	developer name	Mark Kolb	Low
Product	pom	developer name	Nathan Abramson	Low
Product	pom	developer name	Pierre Delisle	Low
Product	pom	developer name	Scott Hasse	Low
Product	pom	developer name	Shawn Bayern	Low
Product	pom	groupid	org.apache.taglibs	Highest
Product	pom	name	Apache Standard Taglib Implementation	High
Product	pom	parent-artifactid	taglibs-standard	Medium
Version	file	version	1.2.5	High
Version	Manifest	Bundle-Version	1.2.5	High
Version	Manifest	Implementation-Version	1.2.5	High
Version	pom	version	1.2.5	Highest

Related Dependencies

Identifiers

pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5 (Confidence:High)
cpe:2.3:a:apache:standard_taglibs:1.2.5:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-api.jar
MD5: 100ccf4edf7ddc8c4ecbf1b2a3fbbfec
SHA1: 9be88554ea988a8cd870cd701cd33ac7254e7893
SHA256:4eb04c5f162e3e97f3b77b8542def17d8bae6156c2291670b81872e9f047f9d8
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-api	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	tomcat	Highest
Vendor	jar	package name	tomcat	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-api	High
Product	jar	package name	apache	Highest
Product	jar	package name	tomcat	Highest
Product	jar	package name	tomcat	Low
Product	Manifest	Bundle-Name	tomcat-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.107	High
Version	Manifest	Implementation-Version	9.0.107	High

Related Dependencies

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-coyote-ffm.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-coyote-ffm.jar
- MD5: 572874db048f3fb614af5e922db7ea2d
- SHA1: 7e05c173820240c4bbdcd15a4049de770176dd10
- SHA256: 8ce684658f1d832c6052c51bb8276cdc72890d4c2e8b854f0b2be49078203b89
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-coyote.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-coyote.jar
- MD5: 2586f80d431bcfab37b57ea3309cea8d
- SHA1: c9576223a9d5903b509213e8b9302ff3e73d812c
- SHA256: 1c0903c7ea67892a2c9fce2f054e724953ab9d87cbaaea022f5c4c874d9dd4b5
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-dbcp.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-dbcp.jar
- MD5: c60c41ed3d1d2a817f11374d35d5544c
- SHA1: 9be5ce24b2ef5b5363d8daa072072853be400548
- SHA256: df5e372bb3ba814bf2f1ca2f5409c06c061e3a8eab41f9a3620f442c0286b943
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-jdbc.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-jdbc.jar
- MD5: 8b59d7da927ea34723a4534d9a348960
- SHA1: 90379d32513c1f6ec691984018ff94bda8315b77
- SHA256: 99445ff21d151be99a980f8cd4bed97b6db2a876c9dd595a3da4da3d6fe168b1
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-jni.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-jni.jar
- MD5: f69ee8e45d7e2968092671e751ce9dd0
- SHA1: f3f13b7d1895216597b60f38c724676f7805152e
- SHA256: 5c9ab7c89ae7d4593762159698f9556c1fbbad7ace08c68cc69da9cf09feadcb
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-util-scan.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-util-scan.jar
- MD5: bf5bff868126f05fcffa3851671444b9
- SHA1: 059d72142c1f1fce255d5b2f8cc811f5c773c037
- SHA256: cd45f2ddd58425889da9e2c9aabe219806fb54882d2ce9f60ee63785896239ca
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-util.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-util.jar
- MD5: 76adbbf0721bc13814793f5dd7848cb8
- SHA1: 793c4502d74778648f9e63db63c8ff754ab8b6c3
- SHA256: d436de3a4962a69feeaefee1ec62da2ec31ceb99cb4459c56b980760cd1c1f64

Identifiers

cpe:2.3:a:apache:tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-i18n-cs.jar
MD5: 82d0ef17b6e99c83f5ff6a481a0ce74a
SHA1: a52916f39f404f87eb44b257b86ef68bcfa9f048
SHA256:41d9a46972fa8a5f27b2949e1c071e178d69eb4350b1022aa2f238069c1a667b
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-cs	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-cs	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-cs	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.107	High

Related Dependencies

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-i18n-de.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-i18n-de.jar
- MD5: 9c83a4cac401a4b5541c3106f4b8f22b
- SHA1: 6dd5d57383340bd6bb09c691363062c0f428387a
- SHA256: ecb6ba8fd43a28376c0f0108cab00546a6252942aeefcd5e1ac51241d28ef0a4
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-i18n-es.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-i18n-es.jar
- MD5: 7e37ceb558f14203b1e925fb37ccb1a5
- SHA1: 66b801d760a508d93ada37a2795d8de8ea13581b
- SHA256: d6b05878de813b0a132bbd48da2f4fe98a48410cb1d2cbe4c275c322d5796814
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-i18n-ja.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-i18n-ja.jar
- MD5: d059c0c23e9247c667c5d59321dc4284
- SHA1: 91937cd40249468e60c808ffff3ab65c538c392e
- SHA256: 42416029a3b2b6a30d8ee6d414ee36cc29e81fe739336e229998fb7b09af89cb
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-i18n-ko.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-i18n-ko.jar
- MD5: e098466c2bca2dfa1cc8df34f1324d65
- SHA1: 915d29fea07aa78d68c81afc670ecfe6f2ff0f82
- SHA256: b401532fd0e29984ddd3bbca221d9a10368efb81b117e9f03ab44d007d153392
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-i18n-pt-BR.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-i18n-pt-BR.jar
- MD5: 4f10fc3b34f53b63cde461936363549f
- SHA1: 4880839059024907aafd43b67e234be553d6e684
- SHA256: d53cc5810f3d8bd24c69447ced0a27ebbb8907d87fd6e00d76e0cae360943abd
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-i18n-ru.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-i18n-ru.jar
- MD5: 5681fb0ca4ab24eb229b03538e40c929
- SHA1: 0458d7f7630170393bde8f816622367e6c9a20fd
- SHA256: e6e615600b66d732f128d5399d65d148ddcddd434ec75def1690807a65ed8f84
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-i18n-zh-CN.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-i18n-zh-CN.jar
- MD5: c39da83fe095638c6f84f5e6791b2599
- SHA1: dc0a185d8ddc1eabe53bb13ea22b8e0779aa847b
- SHA256: d970dbf2effa57f70b2f4273daf54cbbd6ba23ffe1487b39ce92ec744dbdb46e
tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-websocket.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-websocket.jar
- MD5: a3d53334bbf210267c0a7640b90e3eda
- SHA1: aec1a9b916fe8fde3d590373c4dc4469e139368c
- SHA256: 6248154a6a7bc55d1442fa15e006ead8239300a654a9b36dc8828f2ec5ced6a9

Identifiers

cpe:2.3:a:apache:tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\tomcat-i18n-fr.jar
MD5: 4307d97d84c3643f149091de49fd886b
SHA1: 4e2f0e02af4d7afc2063bccb3b8a756a95f0aa80
SHA256:6ec10db8c7a435d4c68509ebc07c72611fa85f19a1af000260d98126f5219d38
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-fr	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-fr	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-fr	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.107	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:nfr:nfr:9.0.107:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\bin\tomcat-juli.jar
MD5: 2eadf2625207a9fe902da8967144f3cf
SHA1: 08355928c66af6b8932906bc8faed1279b37bcad
SHA256:703514e7c8aaef6551147ad34e92f52cdce7cc74048a8117eb0444f2204b91d8
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-juli	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	juli	Highest
Vendor	jar	package name	juli	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-juli	High
Product	jar	package name	apache	Highest
Product	jar	package name	juli	Highest
Product	jar	package name	juli	Low
Product	Manifest	Bundle-Name	tomcat-juli	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.107	High
Version	Manifest	Implementation-Version	9.0.107	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.107:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.107\tomcat-9.0.107.tar.gz\tomcat-9.0.107.tar\apache-tomcat-9.0.107\lib\websocket-api.jar
MD5: 5c31a62a1fc7edcc5c4ab2c284757861
SHA1: 27edae190b6acc6d564ee96766775a9cf07b2849
SHA256:8c3473f42bc3ee914f67e063c9ab109799fc3d417762a14043c2ee96ac8c2a57
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	websocket-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	websocket	Highest
Vendor	jar	package name	websocket	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Vendor	manifest: javax/websocket/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/websocket/server/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	websocket-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	server	Highest
Product	jar	package name	websocket	Highest
Product	jar	package name	websocket	Low
Product	Manifest	Bundle-Name	tomcat-websocket-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Product	manifest: javax/websocket/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/	Specification-Title	WebSocket	Medium
Product	manifest: javax/websocket/server/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/server/	Specification-Title	WebSocket	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	server	Highest
Version	Manifest	Bundle-Version	9.0.107	High
Version	manifest: javax/websocket/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/websocket/server/	Implementation-Version	1.1.FR	Medium

Identifiers

None

How to read the report | Suppressing false positives | Getting Help: github issues Sponsor

Project: tomcat9-config

com.github.hazendaz.tomcat:tomcat9-config:9.0.107

Summary

Dependencies (vulnerable)

checker-qual-3.49.3.jar

Evidence

Identifiers

error_prone_annotations-2.38.0.jar

Evidence

Identifiers

j2objc-annotations-3.0.0.jar

Evidence

Identifiers

jsr305-3.0.2.jar

Evidence

Identifiers

lombok-1.18.38.jar: mavenEcjBootstrapAgent.jar

Evidence

Identifiers

lombok-1.18.38.jar

Evidence

Identifiers

modernizer-maven-annotations-3.1.0.jar

Evidence

Identifiers

spotbugs-annotations-4.9.3.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: annotations-api.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: bootstrap.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: catalina-ant.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: catalina-ha.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: catalina.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: commons-daemon.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: ecj-4.20.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: el-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: jasper-el.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: jasper.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: jaspic-api.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: jsp-api.jar

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: sample.war

Evidence

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: servlet-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: taglibs-standard-impl-1.2.5.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.107.tar.gz: tomcat-9.0.107.tar: tomcat-api.jar

Evidence

How to read the report | Suppressing false positives | Getting Help: github issues

Sponsor