Dependency-Check Report

Dependency	Vulnerability IDs	Package	Highest Severity	CVE Count	Confidence	Evidence Count
checker-qual-3.49.2.jar		pkg:maven/org.checkerframework/checker-qual@3.49.2		0		44
error_prone_annotations-2.37.0.jar		pkg:maven/com.google.errorprone/error_prone_annotations@2.37.0		0		29
j2objc-annotations-3.0.0.jar		pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0		0		33
jsr305-3.0.2.jar		pkg:maven/com.google.code.findbugs/jsr305@3.0.2		0		17
lombok-1.18.38.jar: mavenEcjBootstrapAgent.jar				0		7
lombok-1.18.38.jar		pkg:maven/org.projectlombok/lombok@1.18.38		0		36
modernizer-maven-annotations-3.1.0.jar		pkg:maven/org.gaul/modernizer-maven-annotations@3.1.0		0		19
spotbugs-annotations-4.9.3.jar		pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.3		0		53
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: annotations-api.jar	cpe:2.3:a:apache:tomcat:9.0.105:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Low	30
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: bootstrap.jar	cpe:2.3:a:apache:tomcat:9.0.105:::::::*			0	Highest	16
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: catalina-ant.jar	cpe:2.3:a:apache:ant:9.0.105:::::::* cpe:2.3:a:apache:tomcat:9.0.105:::::::*			0	High	14
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: catalina-ha.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Highest	22
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: catalina.jar	cpe:2.3:a:apache:tomcat:9.0.105:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Highest	20
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: commons-daemon.jar	cpe:2.3:a:apache:apache_commons_daemon:1.4.1:::::::*	pkg:maven/commons-daemon/commons-daemon@1.4.1		0	Low	86
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: ecj-4.20.jar				0		25
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: el-api.jar	cpe:2.3:a:apache:tomcat:3.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*		CRITICAL*	31	Medium	20
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: jasper-el.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Low	26
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: jasper.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Highest	20
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: jaspic-api.jar	cpe:2.3:a:apache:tomcat:9.0.105:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Low	38
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: jsp-api.jar	cpe:2.3:a:apache:tomcat:9.0.105:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Low	39
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: sample.war				0		8
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: servlet-api.jar	cpe:2.3:a:apache:tomcat:4.0.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*		CRITICAL*	30	Medium	41
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: taglibs-standard-impl-1.2.5.jar	cpe:2.3:a:apache:standard_taglibs:1.2.5:::::::*	pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5		0	Highest	54
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-api.jar	cpe:2.3:a:apache:tomcat:9.0.105:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Highest	18
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-i18n-cs.jar	cpe:2.3:a:apache:tomcat:9.0.105:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Low	9
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-i18n-fr.jar	cpe:2.3:a:apache:tomcat:9.0.105:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::* cpe:2.3:a:nfr:nfr:9.0.105:::::::*			0	Low	9
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-juli.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:::::::*			0	Highest	18
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: websocket-api.jar				0		25

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: http://opensource.org/licenses/MIT

File Path: C:\Users\Jeremy\.m2\repository\org\checkerframework\checker-qual\3.49.2\checker-qual-3.49.2.jar
MD5: 41c09e58f686fc6d4e194aa37a1125b0
SHA1: 98ac669ccce59dba8ca360d3e07891d62b6b946a
SHA256:33b1d8b2c4b00f7d4f4b4931424274f3f729474ce3a87cea09a879976a1dcaeb
Referenced In Project/Scope: tomcat9-config:compile
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.105

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	checker-qual	High
Vendor	jar	package name	checker	Highest
Vendor	jar	package name	checkerframework	Highest
Vendor	jar	package name	framework	Highest
Vendor	jar	package name	qual	Highest
Vendor	Manifest	bundle-symbolicname	checker-qual	Medium
Vendor	Manifest	implementation-url	https://checkerframework.org	Low
Vendor	pom	artifactid	checker-qual	Highest
Vendor	pom	artifactid	checker-qual	Low
Vendor	pom	developer email	mernst@cs.washington.edu	Low
Vendor	pom	developer email	smillst@cs.washington.edu	Low
Vendor	pom	developer id	mernst	Medium
Vendor	pom	developer id	smillst	Medium
Vendor	pom	developer name	Michael Ernst	Medium
Vendor	pom	developer name	Suzanne Millstein	Medium
Vendor	pom	developer org	University of Washington	Medium
Vendor	pom	developer org URL	https://www.cs.washington.edu/	Medium
Vendor	pom	groupid	org.checkerframework	Highest
Vendor	pom	name	Checker Qual	High
Vendor	pom	url	https://checkerframework.org/	Highest
Product	file	name	checker-qual	High
Product	jar	package name	checker	Highest
Product	jar	package name	checkerframework	Highest
Product	jar	package name	framework	Highest
Product	jar	package name	qual	Highest
Product	Manifest	Bundle-Name	checker-qual	Medium
Product	Manifest	bundle-symbolicname	checker-qual	Medium
Product	Manifest	implementation-url	https://checkerframework.org	Low
Product	pom	artifactid	checker-qual	Highest
Product	pom	developer email	mernst@cs.washington.edu	Low
Product	pom	developer email	smillst@cs.washington.edu	Low
Product	pom	developer id	mernst	Low
Product	pom	developer id	smillst	Low
Product	pom	developer name	Michael Ernst	Low
Product	pom	developer name	Suzanne Millstein	Low
Product	pom	developer org	University of Washington	Low
Product	pom	developer org URL	https://www.cs.washington.edu/	Low
Product	pom	groupid	org.checkerframework	Highest
Product	pom	name	Checker Qual	High
Product	pom	url	https://checkerframework.org/	Medium
Version	file	version	3.49.2	High
Version	Manifest	Bundle-Version	3.49.2	High
Version	Manifest	Implementation-Version	3.49.2	High
Version	pom	version	3.49.2	Highest

Identifiers

pkg:maven/org.checkerframework/checker-qual@3.49.2 (Confidence:High)

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\errorprone\error_prone_annotations\2.37.0\error_prone_annotations-2.37.0.jar
MD5: dce0a1c83d3dc06c2715c96e11d2c429
SHA1: 8512660d1269d166fad497f51de35da61447f063
SHA256:d29a6263b48d46d4c7c28b64717a6d105b3e2a3e64256092f845e8e774fca6ba
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.105

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	error_prone_annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	errorprone	Highest
Vendor	jar	package name	google	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Vendor	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	error_prone_annotations	Highest
Vendor	pom	artifactid	error_prone_annotations	Low
Vendor	pom	groupid	com.google.errorprone	Highest
Vendor	pom	name	error-prone annotations	High
Vendor	pom	parent-artifactid	error_prone_parent	Low
Product	file	name	error_prone_annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	errorprone	Highest
Product	jar	package name	google	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Product	Manifest	Bundle-Name	error-prone annotations	Medium
Product	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	error_prone_annotations	Highest
Product	pom	groupid	com.google.errorprone	Highest
Product	pom	name	error-prone annotations	High
Product	pom	parent-artifactid	error_prone_parent	Medium
Version	file	version	2.37.0	High
Version	Manifest	Bundle-Version	2.37.0	High
Version	pom	version	2.37.0	Highest

Identifiers

pkg:maven/com.google.errorprone/error_prone_annotations@2.37.0 (Confidence:High)

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\j2objc\j2objc-annotations\3.0.0\j2objc-annotations-3.0.0.jar
MD5: f59529b29202a5baf37f491ea5ec8627
SHA1: 7399e65dd7e9ff3404f4535b2f017093bdb134c7
SHA256:88241573467ddca44ffd4d74aa04c2bbfd11bf7c17e0c342c94c9de7a70a7c64
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.105

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	j2objc-annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	google	Highest
Vendor	jar	package name	j2objc	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	j2objc-annotations	Highest
Vendor	pom	artifactid	j2objc-annotations	Low
Vendor	pom	developer email	tball@google.com	Low
Vendor	pom	developer id	tomball	Medium
Vendor	pom	developer name	Tom Ball	Medium
Vendor	pom	developer org	Google	Medium
Vendor	pom	developer org URL	https://www.google.com	Medium
Vendor	pom	groupid	com.google.j2objc	Highest
Vendor	pom	name	J2ObjC Annotations	High
Vendor	pom	url	google/j2objc/	Highest
Product	file	name	j2objc-annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	google	Highest
Product	jar	package name	j2objc	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	j2objc-annotations	Highest
Product	pom	developer email	tball@google.com	Low
Product	pom	developer id	tomball	Low
Product	pom	developer name	Tom Ball	Low
Product	pom	developer org	Google	Low
Product	pom	developer org URL	https://www.google.com	Low
Product	pom	groupid	com.google.j2objc	Highest
Product	pom	name	J2ObjC Annotations	High
Product	pom	url	google/j2objc/	High
Version	file	version	3.0.0	High
Version	pom	version	3.0.0	Highest

Identifiers

pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0 (Confidence:High)

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\code\findbugs\jsr305\3.0.2\jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.3

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsr305	High
Vendor	Manifest	bundle-symbolicname	org.jsr-305	Medium
Vendor	pom	artifactid	jsr305	Highest
Vendor	pom	artifactid	jsr305	Low
Vendor	pom	groupid	com.google.code.findbugs	Highest
Vendor	pom	name	FindBugs-jsr305	High
Vendor	pom	url	http://findbugs.sourceforge.net/	Highest
Product	file	name	jsr305	High
Product	Manifest	Bundle-Name	FindBugs-jsr305	Medium
Product	Manifest	bundle-symbolicname	org.jsr-305	Medium
Product	pom	artifactid	jsr305	Highest
Product	pom	groupid	com.google.code.findbugs	Highest
Product	pom	name	FindBugs-jsr305	High
Product	pom	url	http://findbugs.sourceforge.net/	Medium
Version	file	version	3.0.2	High
Version	Manifest	Bundle-Version	3.0.2	High
Version	pom	version	3.0.2	Highest

Identifiers

pkg:maven/com.google.code.findbugs/jsr305@3.0.2 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.38\lombok-1.18.38.jar\lombok\launch\mavenEcjBootstrapAgent.jar
MD5: 885d5d6be90a5dcd4b82cdf741e3f31a
SHA1: e1f7f1779f40157fd0b984c1bc32a0cb45cae66e
SHA256:74a80a6ee84e5c6fe497dfcc46a46dbe30578525e747eb531e918ee0750c8da9
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mavenEcjBootstrapAgent	High
Vendor	jar	package name	launch	Low
Vendor	jar	package name	lombok	Low
Vendor	Manifest	can-redefine-classes	true	Low
Product	file	name	mavenEcjBootstrapAgent	High
Product	jar	package name	launch	Low
Product	Manifest	can-redefine-classes	true	Low

Identifiers

None

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: https://projectlombok.org/LICENSE

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.38\lombok-1.18.38.jar
MD5: 789cacd8d3969e9d23e6e6baec747f70
SHA1: 57f8f5e02e92a30fd21b80cbd426a4172b5f8e29
SHA256:1e1e427c36ff63c44fd30ef292d9e773ea3154460ab6265d3fed7e6f5bc50fb9
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.105

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	lombok	High
Vendor	jar	package name	java	Highest
Vendor	jar	package name	lombok	Highest
Vendor	jar	package name	tostring	Highest
Vendor	Manifest	automatic-module-name	lombok	Medium
Vendor	Manifest	can-redefine-classes	true	Low
Vendor	pom	artifactid	lombok	Highest
Vendor	pom	artifactid	lombok	Low
Vendor	pom	developer email	reinier@projectlombok.org	Low
Vendor	pom	developer email	roel@projectlombok.org	Low
Vendor	pom	developer id	rspilker	Medium
Vendor	pom	developer id	rzwitserloot	Medium
Vendor	pom	developer name	Reinier Zwitserloot	Medium
Vendor	pom	developer name	Roel Spilker	Medium
Vendor	pom	groupid	org.projectlombok	Highest
Vendor	pom	name	Project Lombok	High
Vendor	pom	url	https://projectlombok.org	Highest
Product	file	name	lombok	High
Product	jar	package name	java	Highest
Product	jar	package name	lombok	Highest
Product	jar	package name	tostring	Highest
Product	Manifest	automatic-module-name	lombok	Medium
Product	Manifest	can-redefine-classes	true	Low
Product	pom	artifactid	lombok	Highest
Product	pom	developer email	reinier@projectlombok.org	Low
Product	pom	developer email	roel@projectlombok.org	Low
Product	pom	developer id	rspilker	Low
Product	pom	developer id	rzwitserloot	Low
Product	pom	developer name	Reinier Zwitserloot	Low
Product	pom	developer name	Roel Spilker	Low
Product	pom	groupid	org.projectlombok	Highest
Product	pom	name	Project Lombok	High
Product	pom	url	https://projectlombok.org	Medium
Version	file	version	1.18.38	High
Version	Manifest	lombok-version	1.18.38	Medium
Version	pom	version	1.18.38	Highest

Identifiers

pkg:maven/org.projectlombok/lombok@1.18.38 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\gaul\modernizer-maven-annotations\3.1.0\modernizer-maven-annotations-3.1.0.jar
MD5: b188aef3e94d39c7e7a8ebb6b740559f
SHA1: 06eeda8c72054cfccf610ae772f606dbd13acf32
SHA256:1b4e8adc970715721846afeb632edd1c9dc9c07dc052b691c0c8d899c9b9f017
Referenced In Project/Scope: tomcat9-config:provided
modernizer-maven-annotations-3.1.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.105

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	modernizer-maven-annotations	High
Vendor	jar	package name	gaul	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	modernizer-maven-annotations	Highest
Vendor	pom	artifactid	modernizer-maven-annotations	Low
Vendor	pom	groupid	org.gaul	Highest
Vendor	pom	name	Modernizer Maven Plugin annotations	High
Vendor	pom	parent-artifactid	modernizer-maven-parent	Low
Product	file	name	modernizer-maven-annotations	High
Product	jar	package name	gaul	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	modernizer-maven-annotations	Highest
Product	pom	groupid	org.gaul	Highest
Product	pom	name	Modernizer Maven Plugin annotations	High
Product	pom	parent-artifactid	modernizer-maven-parent	Medium
Version	file	version	3.1.0	High
Version	pom	version	3.1.0	Highest

Identifiers

pkg:maven/org.gaul/modernizer-maven-annotations@3.1.0 (Confidence:High)

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html

File Path: C:\Users\Jeremy\.m2\repository\com\github\spotbugs\spotbugs-annotations\4.9.3\spotbugs-annotations-4.9.3.jar
MD5: 6149845e438bd5a34ebaf81f8bc9e243
SHA1: 4d362bffcfdfd734999e94d7d98fde678aae71cf
SHA256:13532bfe2f45fcd491432221df72d9cd0efb8f987c9245e12befa192c8925ce3
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.105

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spotbugs-annotations	High
Vendor	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Vendor	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Vendor	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Vendor	pom	artifactid	spotbugs-annotations	Highest
Vendor	pom	artifactid	spotbugs-annotations	Low
Vendor	pom	developer email	andreas.sewe@codetrails.com	Low
Vendor	pom	developer email	dbrosius@mebigfatguy.com	Low
Vendor	pom	developer email	loskutov@gmx.de	Low
Vendor	pom	developer email	skypencil@gmail.com	Low
Vendor	pom	developer id	henrik242	Medium
Vendor	pom	developer id	iloveeclipse	Medium
Vendor	pom	developer id	jsotuyod	Medium
Vendor	pom	developer id	KengoTODA	Medium
Vendor	pom	developer id	mebigfatguy	Medium
Vendor	pom	developer id	sewe	Medium
Vendor	pom	developer id	ThrawnCA	Medium
Vendor	pom	developer name	Andreas Sewe	Medium
Vendor	pom	developer name	Andrey Loskutov	Medium
Vendor	pom	developer name	Dave Brosius	Medium
Vendor	pom	developer name	Juan Martín Sotuyo Dodero	Medium
Vendor	pom	developer name	Kengo TODA	Medium
Vendor	pom	groupid	com.github.spotbugs	Highest
Vendor	pom	name	SpotBugs Annotations	High
Vendor	pom	url	https://spotbugs.github.io/	Highest
Product	file	name	spotbugs-annotations	High
Product	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Product	Manifest	Bundle-Name	spotbugs-annotations	Medium
Product	Manifest	bundle-requiredexecutionenvironment	JavaSE-11	Low
Product	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Product	pom	artifactid	spotbugs-annotations	Highest
Product	pom	developer email	andreas.sewe@codetrails.com	Low
Product	pom	developer email	dbrosius@mebigfatguy.com	Low
Product	pom	developer email	loskutov@gmx.de	Low
Product	pom	developer email	skypencil@gmail.com	Low
Product	pom	developer id	henrik242	Low
Product	pom	developer id	iloveeclipse	Low
Product	pom	developer id	jsotuyod	Low
Product	pom	developer id	KengoTODA	Low
Product	pom	developer id	mebigfatguy	Low
Product	pom	developer id	sewe	Low
Product	pom	developer id	ThrawnCA	Low
Product	pom	developer name	Andreas Sewe	Low
Product	pom	developer name	Andrey Loskutov	Low
Product	pom	developer name	Dave Brosius	Low
Product	pom	developer name	Juan Martín Sotuyo Dodero	Low
Product	pom	developer name	Kengo TODA	Low
Product	pom	groupid	com.github.spotbugs	Highest
Product	pom	name	SpotBugs Annotations	High
Product	pom	url	https://spotbugs.github.io/	Medium
Version	file	version	4.9.3	High
Version	Manifest	Bundle-Version	4.9.3	High
Version	pom	version	4.9.3	Highest

Identifiers

pkg:maven/com.github.spotbugs/spotbugs-annotations@4.9.3 (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\annotations-api.jar
MD5: 33c6b2cafedb8a6488aefd8938e23557
SHA1: 0ce2f716b539888f221a378d78d666ec2bfb9f95
SHA256:3faff5881f3992a199b561d40efe5919330c4d6e1e62c6fbe83ad6ac83de820b
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	annotations-api	High
Vendor	jar	package name	annotation	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Vendor	manifest: javax/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/security/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/sql/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	annotations-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	annotation	Low
Product	jar	package name	javax	Highest
Product	jar	package name	security	Highest
Product	jar	package name	sql	Highest
Product	Manifest	Bundle-Name	tomcat-annotations-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Product	manifest: javax/annotation/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/security/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/security/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/sql/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/sql/	Specification-Title	Common Annotations	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	security	Highest
Version	jar	package name	sql	Highest
Version	Manifest	Bundle-Version	9.0.105	High
Version	manifest: javax/annotation/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/security/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/sql/	Implementation-Version	1.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\bin\bootstrap.jar
MD5: 091782c6901bc449fb055f56d62ab5cd
SHA1: 792b4cd709c9c2f0b00a59ada051207acac3d643
SHA256:72d207f4b5c05d14dd338bc26126ac4798ecf931b9689e7a1d7a74142dc98d69
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	bootstrap	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	startup	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	bootstrap	High
Product	jar	package name	apache	Highest
Product	jar	package name	bootstrap	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	startup	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Implementation-Title	Apache Tomcat Bootstrap	High
Product	Manifest	specification-title	Apache Tomcat Bootstrap	Medium
Version	Manifest	Implementation-Version	9.0.105	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\catalina-ant.jar
MD5: 9db8ac2ae7578a34f423982147909114
SHA1: 65b2a46a838ee92dfd9c13ceade8da0e30e3cd1f
SHA256:643b7189073a1535e38e0832818146faec94e0890d6fe114e3f7f2b8f33f5934
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ant	High
Vendor	jar	package name	ant	Low
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ant	High
Product	jar	package name	ant	Low
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Low
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Implementation-Version	9.0.105	High

Identifiers

cpe:2.3:a:apache:ant:9.0.105:*:*:*:*:*:*:* (Confidence:High)
cpe:2.3:a:apache:tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\catalina-ha.jar
MD5: 12b9fc1f98e671110ae9025f8117e1a0
SHA1: 90e8b53b943535d63fcd7033393618920d2a9a70
SHA256:b2ad24ed4855d1202e9cbedaed7007981043a96a0736866691b2c9909a3edda7
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ha	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	ha	Highest
Vendor	jar	package name	ha	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ha	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	ha	Highest
Product	jar	package name	ha	Low
Product	Manifest	Bundle-Name	tomcat-catalina-ha	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.105	High
Version	Manifest	Implementation-Version	9.0.105	High

Related Dependencies

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\catalina.jar
MD5: 65dfe59d05f197003b291ba7f4930d8f
SHA1: c0a4ed746f11f1aa9557a484bdb14f005a798b2a
SHA256:38a0200366b505abdd5cf9bd164bb9f24b22a968c431644a1107fc8d3b334656
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-catalina	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.105	High
Version	Manifest	Implementation-Version	9.0.105	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Highest)

Description:

    Apache Commons Daemon software is a set of utilities and Java support
    classes for running Java applications as server processes. These are
    commonly known as 'daemon' processes in Unix terminology (hence the
    name). On Windows they are called 'services'.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\bin\commons-daemon.jar
MD5: 00d973e42c1620f71f81e6c78d02fa2d
SHA1: 8308391bc284f7890139b58272819480594135fb
SHA256:fd306f20fbe9ab60c2e06a8b8bdda786d8d2e1a10bfe475cde89f1b7864f4e7e
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-daemon	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	daemon	Highest
Vendor	jar	package name	support	Highest
Vendor	Manifest	build-jdk-spec	23	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.apache	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-daemon	Low
Vendor	pom	developer email	billbarker at apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	jfclere at apache.org	Low
Vendor	pom	developer email	mturk at apache.org	Low
Vendor	pom	developer email	pier at apache.org	Low
Vendor	pom	developer email	remm at apache.org	Low
Vendor	pom	developer email	yoavs at apache.org	Low
Vendor	pom	developer id	billbarker	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	jfclere	Medium
Vendor	pom	developer id	mturk	Medium
Vendor	pom	developer id	pier	Medium
Vendor	pom	developer id	remm	Medium
Vendor	pom	developer id	yoavs	Medium
Vendor	pom	developer name	Bill Barker	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Jean-Frederic Clere	Medium
Vendor	pom	developer name	Mladen Turk	Medium
Vendor	pom	developer name	Pier Fumagalli	Medium
Vendor	pom	developer name	Remy Maucherat	Medium
Vendor	pom	developer name	Yoav Shapira	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-daemon	Highest
Vendor	pom	name	Apache Commons Daemon	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-daemon/	Highest
Product	file	name	commons-daemon	High
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	daemon	Highest
Product	jar	package name	support	Highest
Product	Manifest	build-jdk-spec	23	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Product	Manifest	Bundle-Name	Apache Commons Daemon	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Product	Manifest	Implementation-Title	Apache Commons Daemon	High
Product	Manifest	multi-release	true	Low
Product	Manifest	specification-title	Apache Commons Daemon	Medium
Product	pom	artifactid	commons-daemon	Highest
Product	pom	developer email	billbarker at apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	jfclere at apache.org	Low
Product	pom	developer email	mturk at apache.org	Low
Product	pom	developer email	pier at apache.org	Low
Product	pom	developer email	remm at apache.org	Low
Product	pom	developer email	yoavs at apache.org	Low
Product	pom	developer id	billbarker	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	jfclere	Low
Product	pom	developer id	mturk	Low
Product	pom	developer id	pier	Low
Product	pom	developer id	remm	Low
Product	pom	developer id	yoavs	Low
Product	pom	developer name	Bill Barker	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Jean-Frederic Clere	Low
Product	pom	developer name	Mladen Turk	Low
Product	pom	developer name	Pier Fumagalli	Low
Product	pom	developer name	Remy Maucherat	Low
Product	pom	developer name	Yoav Shapira	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-daemon	Highest
Product	pom	name	Apache Commons Daemon	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-daemon/	Medium
Version	Manifest	Bundle-Version	1.4.1	High
Version	Manifest	Implementation-Version	1.4.1	High
Version	pom	parent-version	1.4.1	Low
Version	pom	version	1.4.1	Highest

Identifiers

pkg:maven/commons-daemon/commons-daemon@1.4.1 (Confidence:High)
cpe:2.3:a:apache:apache_commons_daemon:1.4.1:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\ecj-4.20.jar
MD5: ee47966a67cd4019f1b8ccac74ba8dca
SHA1: 4837be609a3368a0f7e7cf0dc1bdbc7fe94993de
SHA256:ac0ba5876eaf7ebb47749a0d1be179c51f194b9dd0b875d1c09e1b530f5a2db5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	ecj	High
Vendor	jar	package name	compiler	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	eclipse	Low
Vendor	jar	package name	internal	Low
Vendor	jar	package name	jdt	Highest
Vendor	jar	package name	jdt	Low
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Product	file	name	ecj	High
Product	jar	package name	compiler	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	core	Highest
Product	jar	package name	eclipse	Highest
Product	jar	package name	internal	Low
Product	jar	package name	jdt	Highest
Product	jar	package name	jdt	Low
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	Eclipse Compiler for Java(TM)	Medium
Product	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Version	file	name	ecj	Medium
Version	file	version	4.20	High
Version	Manifest	build-jdk-spec	11	Low
Version	Manifest	Bundle-Version	3.26.0.v20210609-0549	High

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\el-api.jar
MD5: f54352ebc9e7cde1aeac56cbf531ed31
SHA1: 6974a4bf94e78fc2e0221f3b99f2d7e417758ca7
SHA256:0b5b3cd9aa9344dd438b86c27ea0f1700710c3da708a3dc4c862b870b39856a7
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Vendor	manifest: javax/el/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expression	Highest
Product	jar	package name	javax	Highest
Product	Manifest	Bundle-Name	tomcat-el-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Product	manifest: javax/el/	Implementation-Title	javax.el	Medium
Product	manifest: javax/el/	Specification-Title	Expression Language	Medium
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.105	High
Version	manifest: javax/el/	Implementation-Version	3.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-0493

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST
cve@mitre.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0044

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2000-0760

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2000-0672

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

CVE-2000-1210

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

CVE-2001-0590

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0042

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0043

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0045

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-0808

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\jasper-el.jar
MD5: b9c71e8bd9c20cb75cc6e4d065369808
SHA1: 9162ffa57831ff13cda4deb4669d12f10caa0f46
SHA256:8c1c10225a13f8de1ee98ff432d2f0fab48098eedfba65689580ca1814487ed1
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	parser	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expressionfactoryimpl	Highest
Product	jar	package name	parser	Low
Product	Manifest	Bundle-Name	tomcat-jasper-el	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	jar	package name	apache	Highest
Version	jar	package name	el	Highest
Version	jar	package name	expressionfactoryimpl	Highest
Version	Manifest	Bundle-Version	9.0.105	High
Version	Manifest	Implementation-Version	9.0.105	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\jasper.jar
MD5: b14c6cc42690aa9baeefb609b0790b0d
SHA1: 2e7a541253f8a1a0076111b0239d70a0ca662d3c
SHA256:c67993f8f1f074f9c324bb34b0feaaa57b10b892f78492f4e149cd7fd310873f
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	compiler	Low
Vendor	jar	package name	jasper	Highest
Vendor	jar	package name	jasper	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper	High
Product	jar	package name	apache	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	jasper	Highest
Product	jar	package name	jasper	Low
Product	Manifest	Bundle-Name	tomcat-jasper	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.105	High
Version	Manifest	Implementation-Version	9.0.105	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\jaspic-api.jar
MD5: 1204bc1fbbbda6e9b252fd4209b362a2
SHA1: caeae94bc8177e4fb85a0fc55fe90bb6a073502c
SHA256:96617a85c76a5969ba711a2cd06ddb467b18a30b4e2d89f9e63c1bfab8cd866f
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jaspic-api	High
Vendor	jar	package name	auth	Low
Vendor	jar	package name	javax	Low
Vendor	jar	package name	security	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Vendor	manifest: javax/security/auth/message/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/callback/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/config/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/module/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jaspic-api	High
Product	jar	package name	auth	Highest
Product	jar	package name	auth	Low
Product	jar	package name	javax	Highest
Product	jar	package name	message	Highest
Product	jar	package name	message	Low
Product	jar	package name	security	Highest
Product	jar	package name	security	Low
Product	Manifest	Bundle-Name	tomcat-jaspic-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Product	manifest: javax/security/auth/message/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/callback/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/callback/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/config/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/config/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/module/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/module/	Specification-Title	Java Authentication SPI for Containers	Medium
Version	jar	package name	auth	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	message	Highest
Version	jar	package name	security	Highest
Version	Manifest	Bundle-Version	9.0.105	High
Version	manifest: javax/security/auth/message/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/callback/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/config/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/module/	Implementation-Version	1.1.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\jsp-api.jar
MD5: 81881b7e0b66642b3f2689a68dc5aab1
SHA1: 749a36e102ebc5023dc1dc37e3c592df38821dd7
SHA256:97762202c4aabc93e6a16994e08d2d803998c70748533f98b4048ac7efde7d7a
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsp-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	jsp	Low
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Vendor	manifest: javax/servlet/jsp/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/tagext/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jsp-api	High
Product	jar	package name	el	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	jsp	Low
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	jar	package name	tagext	Highest
Product	Manifest	Bundle-Name	tomcat-jsp-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Product	manifest: javax/servlet/jsp/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/el/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/el/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/resources/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/resources/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/tagext/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/tagext/	Specification-Title	Java API for JavaServer Pages	Medium
Version	jar	package name	el	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	servlet	Highest
Version	jar	package name	tagext	Highest
Version	Manifest	Bundle-Version	9.0.105	High
Version	manifest: javax/servlet/jsp/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/el/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/resources/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/tagext/	Implementation-Version	2.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\webapps\docs\appdev\sample\sample.war
MD5: 570f196c4a1025a717269d16d11d6f37
SHA1: 80f5053b166c69d81697ba21113c673f8372aca0
SHA256:89b33caa5bf4cfd235f060c396cb1a5acb2734a1366db325676f48c5f5ed92e5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	sample	High
Vendor	jar	package name	classes	Low
Vendor	jar	package name	mypackage	Low
Vendor	jar	package name	web-inf	Low
Product	file	name	sample	High
Product	jar	package name	classes	Low
Product	jar	package name	hello	Low
Product	jar	package name	mypackage	Low

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\servlet-api.jar
MD5: 97b07f4df99475ef48cf44b4a7363f46
SHA1: b823e65b727b044ed972f06548c57d970b432a41
SHA256:fff171d61d599871d3115277e14c246df8e9dd50bab0ac5470554d1f12c11586
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	servlet-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	servlet	Highest
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Vendor	manifest: javax/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	servlet-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	Manifest	Bundle-Name	tomcat-servlet-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Product	manifest: javax/servlet/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/annotation/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/annotation/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/descriptor/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/descriptor/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/http/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/http/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/resources/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/resources/	Specification-Title	Java API for Servlets	Medium
Version	jar	package name	annotation	Highest
Version	jar	package name	descriptor	Highest
Version	jar	package name	http	Highest
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.105	High
Version	manifest: javax/servlet/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/annotation/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/descriptor/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/http/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/resources/	Implementation-Version	4.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,PATCH
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,PATCH
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2272

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSSv2:

Base Score: HIGH (7.8)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
cve@mitre.org - EXPLOIT,PATCH
cve@mitre.org - PATCH

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

NVD-CWE-Other

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0866

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-1355

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
secalert@redhat.com - EXPLOIT,PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-3383

Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,US_GOVERNMENT_RESOURCE
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - TOOL_SIGNATURE
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - TOOL_SIGNATURE
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-2450

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-5461

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
secalert@redhat.com - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-5519

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - EXPLOIT,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

        An implementation of the JSP Standard Tag Library (JSTL).

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\webapps\examples\WEB-INF\lib\taglibs-standard-impl-1.2.5.jar
MD5: 8e5c8db242fbef3db1acfcbb3bc8ec8b
SHA1: 9b9783ccb2a323383e6e20e36d368f8997b71967
SHA256:d075cb77d94e2d115b4d90a897b57d65cc31ed8e1b95d65361da324642705728
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	taglibs-standard-impl	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	standard	Highest
Vendor	jar	package name	tag	Highest
Vendor	jar	package name	taglibs	Highest
Vendor	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Vendor	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Vendor	pom	artifactid	taglibs-standard-impl	Low
Vendor	pom	developer name	Bjorn Townsend	Medium
Vendor	pom	developer name	Dmitri Plotnikov	Medium
Vendor	pom	developer name	Felipe Leme	Medium
Vendor	pom	developer name	Glenn Nielsen	Medium
Vendor	pom	developer name	Hans Bergsten	Medium
Vendor	pom	developer name	Henri Yandell	Medium
Vendor	pom	developer name	Jan Luehe	Medium
Vendor	pom	developer name	Justyna Horwat	Medium
Vendor	pom	developer name	Mark Kolb	Medium
Vendor	pom	developer name	Nathan Abramson	Medium
Vendor	pom	developer name	Pierre Delisle	Medium
Vendor	pom	developer name	Scott Hasse	Medium
Vendor	pom	developer name	Shawn Bayern	Medium
Vendor	pom	groupid	org.apache.taglibs	Highest
Vendor	pom	name	Apache Standard Taglib Implementation	High
Vendor	pom	parent-artifactid	taglibs-standard	Low
Product	file	name	taglibs-standard-impl	High
Product	jar	package name	apache	Highest
Product	jar	package name	standard	Highest
Product	jar	package name	tag	Highest
Product	jar	package name	taglibs	Highest
Product	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Product	Manifest	Bundle-Name	Apache Standard Taglib Implementation	Medium
Product	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Product	Manifest	Implementation-Title	Apache Standard Taglib Implementation	High
Product	pom	artifactid	taglibs-standard-impl	Highest
Product	pom	developer name	Bjorn Townsend	Low
Product	pom	developer name	Dmitri Plotnikov	Low
Product	pom	developer name	Felipe Leme	Low
Product	pom	developer name	Glenn Nielsen	Low
Product	pom	developer name	Hans Bergsten	Low
Product	pom	developer name	Henri Yandell	Low
Product	pom	developer name	Jan Luehe	Low
Product	pom	developer name	Justyna Horwat	Low
Product	pom	developer name	Mark Kolb	Low
Product	pom	developer name	Nathan Abramson	Low
Product	pom	developer name	Pierre Delisle	Low
Product	pom	developer name	Scott Hasse	Low
Product	pom	developer name	Shawn Bayern	Low
Product	pom	groupid	org.apache.taglibs	Highest
Product	pom	name	Apache Standard Taglib Implementation	High
Product	pom	parent-artifactid	taglibs-standard	Medium
Version	file	version	1.2.5	High
Version	Manifest	Bundle-Version	1.2.5	High
Version	Manifest	Implementation-Version	1.2.5	High
Version	pom	version	1.2.5	Highest

Related Dependencies

Identifiers

pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5 (Confidence:High)
cpe:2.3:a:apache:standard_taglibs:1.2.5:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-api.jar
MD5: ab7c043e3df0fdbdd0eade548c950443
SHA1: b263f24abfd8118e5a50edc390d88cc9078e22df
SHA256:26e838891c516ab64ebc43266f326316b1a7d28c98663523fde9c71854488b51
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-api	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	tomcat	Highest
Vendor	jar	package name	tomcat	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-api	High
Product	jar	package name	apache	Highest
Product	jar	package name	tomcat	Highest
Product	jar	package name	tomcat	Low
Product	Manifest	Bundle-Name	tomcat-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.105	High
Version	Manifest	Implementation-Version	9.0.105	High

Related Dependencies

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-coyote-ffm.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-coyote-ffm.jar
- MD5: 747189640a6b46700159af4be8acf6cf
- SHA1: ae3a7c30ee47e90d327986a7253001ee6f2174d7
- SHA256: b93ce61b671b265713e343b6bbd73b2670be27687cfa703c1171c5be79dc3338
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-coyote.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-coyote.jar
- MD5: 86076667e1f402add3eecb30f3319e42
- SHA1: 02964d374772bbdfd26ac705d283c2dbd239827b
- SHA256: 8d4a62552e6a4bd4b52504f9c4f1e6af332cc48488e53b1de4d8917015187c05
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-dbcp.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-dbcp.jar
- MD5: 26c2c973c6782fc4a46cd49d3bbf0755
- SHA1: d19054baeaaa11eaf7f7a0e0055a9562424178f1
- SHA256: 522d3ca3e140033b5e6027c174ce9cfb5a4a32075f654f2b8b4672dda07812cf
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-jdbc.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-jdbc.jar
- MD5: 3845657ef41d8d0c3474777bb94805d9
- SHA1: abaf6eb619e545603c897099bbf6e9779d404883
- SHA256: 7c6c825213a14257a511c426ec98eeaf71cfdc0a6bc5a716caef6378ca11caa8
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-jni.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-jni.jar
- MD5: f8ad5a0ba175e5cd3a07a25e2cc45763
- SHA1: 6baffd0b1c3525c67db9e1375d605040bb63468d
- SHA256: d9a263be9c60cd511567d44a2b2eb81143db58795e64a81e78177ec84f31a383
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-util-scan.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-util-scan.jar
- MD5: 0b2bb8411b92edc8e4238dd05e07f203
- SHA1: 304c1aabf3cb27e8e13ec052a843ea6010f0a3a4
- SHA256: 6d21ce98912dffc67b21f853cb29f0339558ef99e3b0d8cd27cc2a60fa1cb24b
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-util.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-util.jar
- MD5: ba39346ad3b9059539d699166f1ca411
- SHA1: bb2564cd708ba78b55097af7e41dcf20970f5674
- SHA256: 84ac881ee5c1daa4caf4150ddecd86b457c4e57cb22526e0f9ebda72dccb61e0

Identifiers

cpe:2.3:a:apache:tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-i18n-cs.jar
MD5: 91a0c38d7307f4dd730bba8a49add2bc
SHA1: ef401bc44ebd416a96c5a98dfcb427e971856806
SHA256:8357ef732ffb892f4f75b8b9f24b72d20457318d74a4c853c1ad5ba923ce4a29
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-cs	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-cs	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-cs	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.105	High

Related Dependencies

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-i18n-de.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-i18n-de.jar
- MD5: c268190d768b53adbc37cc2f0c8f950f
- SHA1: 6570fc8145798004be88b3e9a2c9946dd1771a5e
- SHA256: d712d40d2b6f373da3cc69746128bf672950a7a0518a3239d25c0ae70f69f75a
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-i18n-es.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-i18n-es.jar
- MD5: d53db793a03b18656b3a90227140ddbf
- SHA1: 495cf432d2659cb74127a6966a51926693237f6f
- SHA256: d3bcbe91c1ec48d7c0df660c9759d8b6677656a70f56e3542bc832088b6c1d44
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-i18n-ja.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-i18n-ja.jar
- MD5: 24cbb37b15a9da83a1948e720290dc48
- SHA1: 568b4dadac5812849b402811eb9f7087c3ff2206
- SHA256: caa25939a4cd2ea0b59a7a2b6e93c4afdaf2bc66dd35e3b0bfd805aeab00e19b
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-i18n-ko.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-i18n-ko.jar
- MD5: 9490688e4faa983305c2905d0c28094f
- SHA1: 2408cabd74622a08da8a1111b0db81facf885ac1
- SHA256: 7e4383a55f414931bf59f16dde0d2d08cfac37f20ce5000095d03e8038937fbb
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-i18n-pt-BR.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-i18n-pt-BR.jar
- MD5: ce7ebd897facc5a15fe549c0e1b2860e
- SHA1: 168542ead0f97c2a20401aed857062f109992815
- SHA256: 5ea1cb16e52b3c016b36f9233ef42cb23e4368a3e3d01dce6d703130a25465e4
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-i18n-ru.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-i18n-ru.jar
- MD5: 388bcabcffc3fc434d0eea9dd291b1f6
- SHA1: 98d980ae2a31d4a204bcb11a8cab3fa7a30525cf
- SHA256: 84824fecf214faf20aa3a6c0d21e2c236b6783e0391bf8ab6fc4a6fa1779b8fe
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-i18n-zh-CN.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-i18n-zh-CN.jar
- MD5: 3bd8cadbd49e53502be47c4b066a37e5
- SHA1: e14b73b8ad90b6b9249f4e4f59af8ba111d8896f
- SHA256: e153b29e0a83927d21fa72231880b83038c209792cf77f9ae4c6c15773cf7591
tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-websocket.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-websocket.jar
- MD5: d345f4a587787155547654bf1ea07e2f
- SHA1: f0f026669fd33ffbba9aff9a3b6d27c640e3996a
- SHA256: c6b945e51f402092859313873b7c0069deb8763c47302ea1a65e9aed4ffda744

Identifiers

cpe:2.3:a:apache:tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\tomcat-i18n-fr.jar
MD5: 997efab743a5d5827c72c18eab4b088a
SHA1: 645d2f509a9627b7408e2606cfdf7548053ea51e
SHA256:c4cc3426d29a55cc90bdf91083eec27153fe84c3b5583d8486a34ff67d7a77ca
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-fr	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-fr	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-fr	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.105	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:nfr:nfr:9.0.105:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\bin\tomcat-juli.jar
MD5: 000378d29d49f52534a01dc1802e824c
SHA1: 60e0a87cf11c87d219787c5bc85bf7c76be1934c
SHA256:7724b4c4afa2f4521f539688fed01ec331cdfb75ecd6e53db378e8591eba44fd
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-juli	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	juli	Highest
Vendor	jar	package name	juli	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-juli	High
Product	jar	package name	apache	Highest
Product	jar	package name	juli	Highest
Product	jar	package name	juli	Low
Product	Manifest	Bundle-Name	tomcat-juli	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.105	High
Version	Manifest	Implementation-Version	9.0.105	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.105:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.105\tomcat-9.0.105.tar.gz\tomcat-9.0.105.tar\apache-tomcat-9.0.105\lib\websocket-api.jar
MD5: 03b3fe6e086f7d6919447f5abd42ef9a
SHA1: 8d65dd5f78b1342bfacefad188c585fe9e1793d5
SHA256:20b37e137510841204679caaa2eae5abac57389e15c74d686975a1c035c0504d
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	websocket-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	websocket	Highest
Vendor	jar	package name	websocket	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Vendor	manifest: javax/websocket/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/websocket/server/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	websocket-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	server	Highest
Product	jar	package name	websocket	Highest
Product	jar	package name	websocket	Low
Product	Manifest	Bundle-Name	tomcat-websocket-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Product	manifest: javax/websocket/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/	Specification-Title	WebSocket	Medium
Product	manifest: javax/websocket/server/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/server/	Specification-Title	WebSocket	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	server	Highest
Version	Manifest	Bundle-Version	9.0.105	High
Version	manifest: javax/websocket/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/websocket/server/	Implementation-Version	1.1.FR	Medium

Identifiers

None

How to read the report | Suppressing false positives | Getting Help: github issues Sponsor

Project: tomcat9-config

com.github.hazendaz.tomcat:tomcat9-config:9.0.105

Summary

Dependencies (vulnerable)

checker-qual-3.49.2.jar

Evidence

Identifiers

error_prone_annotations-2.37.0.jar

Evidence

Identifiers

j2objc-annotations-3.0.0.jar

Evidence

Identifiers

jsr305-3.0.2.jar

Evidence

Identifiers

lombok-1.18.38.jar: mavenEcjBootstrapAgent.jar

Evidence

Identifiers

lombok-1.18.38.jar

Evidence

Identifiers

modernizer-maven-annotations-3.1.0.jar

Evidence

Identifiers

spotbugs-annotations-4.9.3.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: annotations-api.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: bootstrap.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: catalina-ant.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: catalina-ha.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: catalina.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: commons-daemon.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: ecj-4.20.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: el-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: jasper-el.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: jasper.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: jaspic-api.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: jsp-api.jar

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: sample.war

Evidence

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: servlet-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: taglibs-standard-impl-1.2.5.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.105.tar.gz: tomcat-9.0.105.tar: tomcat-api.jar

Evidence

How to read the report | Suppressing false positives | Getting Help: github issues

Sponsor