Dependency-Check Report

Dependency	Vulnerability IDs	Package	Highest Severity	CVE Count	Confidence	Evidence Count
checker-qual-3.48.2.jar		pkg:maven/org.checkerframework/checker-qual@3.48.2		0		44
error_prone_annotations-2.35.1.jar		pkg:maven/com.google.errorprone/error_prone_annotations@2.35.1		0		29
j2objc-annotations-3.0.0.jar		pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0		0		33
jsr305-3.0.2.jar		pkg:maven/com.google.code.findbugs/jsr305@3.0.2		0		17
lombok-1.18.36.jar: mavenEcjBootstrapAgent.jar				0		7
lombok-1.18.36.jar		pkg:maven/org.projectlombok/lombok@1.18.36		0		36
modernizer-maven-annotations-2.9.0.jar		pkg:maven/org.gaul/modernizer-maven-annotations@2.9.0		0		19
spotbugs-annotations-4.8.6.jar		pkg:maven/com.github.spotbugs/spotbugs-annotations@4.8.6		0		53
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: annotations-api.jar	cpe:2.3:a:apache:tomcat:9.0.98:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Low	30
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: bootstrap.jar	cpe:2.3:a:apache:tomcat:9.0.98:::::::*			0	Highest	16
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: catalina-ant.jar	cpe:2.3:a:apache:ant:9.0.98:::::::* cpe:2.3:a:apache:tomcat:9.0.98:::::::*			0	High	14
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: catalina-ha.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Highest	22
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: catalina.jar	cpe:2.3:a:apache:tomcat:9.0.98:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Highest	20
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: commons-daemon.jar	cpe:2.3:a:apache:apache_commons_daemon:1.4.0:::::::*	pkg:maven/commons-daemon/commons-daemon@1.4.0		0	Low	84
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: ecj-4.20.jar				0		25
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: el-api.jar	cpe:2.3:a:apache:tomcat:3.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*		CRITICAL*	31	Medium	20
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: jasper-el.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Low	26
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: jasper.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Highest	20
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: jaspic-api.jar	cpe:2.3:a:apache:tomcat:9.0.98:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Low	38
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: jsp-api.jar	cpe:2.3:a:apache:tomcat:9.0.98:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Low	39
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: sample.war				0		8
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: servlet-api.jar	cpe:2.3:a:apache:tomcat:4.0.0:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*		CRITICAL*	30	Medium	41
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: taglibs-standard-impl-1.2.5.jar	cpe:2.3:a:apache:standard_taglibs:1.2.5:::::::*	pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5		0	Highest	54
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-api.jar	cpe:2.3:a:apache:tomcat:9.0.98:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Highest	18
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-i18n-cs.jar	cpe:2.3:a:apache:tomcat:9.0.98:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Low	9
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-i18n-fr.jar	cpe:2.3:a:apache:tomcat:9.0.98:::::::* cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::* cpe:2.3:a:nfr:nfr:9.0.98:::::::*			0	Low	9
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-juli.jar	cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:::::::*			0	Highest	18
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: websocket-api.jar				0		25

Description:

checker-qual contains annotations (type qualifiers) that a programmerwrites to specify Java code for type-checking by the Checker Framework.

License:

The MIT License: http://opensource.org/licenses/MIT

File Path: C:\Users\Jeremy\.m2\repository\org\checkerframework\checker-qual\3.48.2\checker-qual-3.48.2.jar
MD5: dbf6dc63dfb8a5b4c739cb844fd66dcd
SHA1: 2a4797df796b23026b8215545b0d2936bacc52af
SHA256:af23f20c995b2fede35b1eba81177a9a66944ec67b8e4dee19aa4cc0b710c6b5
Referenced In Project/Scope: tomcat9-config:compile
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.98

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	checker-qual	High
Vendor	jar	package name	checker	Highest
Vendor	jar	package name	checkerframework	Highest
Vendor	jar	package name	framework	Highest
Vendor	jar	package name	qual	Highest
Vendor	Manifest	bundle-symbolicname	checker-qual	Medium
Vendor	Manifest	implementation-url	https://checkerframework.org	Low
Vendor	pom	artifactid	checker-qual	Highest
Vendor	pom	artifactid	checker-qual	Low
Vendor	pom	developer email	mernst@cs.washington.edu	Low
Vendor	pom	developer email	smillst@cs.washington.edu	Low
Vendor	pom	developer id	mernst	Medium
Vendor	pom	developer id	smillst	Medium
Vendor	pom	developer name	Michael Ernst	Medium
Vendor	pom	developer name	Suzanne Millstein	Medium
Vendor	pom	developer org	University of Washington	Medium
Vendor	pom	developer org URL	https://www.cs.washington.edu/	Medium
Vendor	pom	groupid	org.checkerframework	Highest
Vendor	pom	name	Checker Qual	High
Vendor	pom	url	https://checkerframework.org/	Highest
Product	file	name	checker-qual	High
Product	jar	package name	checker	Highest
Product	jar	package name	checkerframework	Highest
Product	jar	package name	framework	Highest
Product	jar	package name	qual	Highest
Product	Manifest	Bundle-Name	checker-qual	Medium
Product	Manifest	bundle-symbolicname	checker-qual	Medium
Product	Manifest	implementation-url	https://checkerframework.org	Low
Product	pom	artifactid	checker-qual	Highest
Product	pom	developer email	mernst@cs.washington.edu	Low
Product	pom	developer email	smillst@cs.washington.edu	Low
Product	pom	developer id	mernst	Low
Product	pom	developer id	smillst	Low
Product	pom	developer name	Michael Ernst	Low
Product	pom	developer name	Suzanne Millstein	Low
Product	pom	developer org	University of Washington	Low
Product	pom	developer org URL	https://www.cs.washington.edu/	Low
Product	pom	groupid	org.checkerframework	Highest
Product	pom	name	Checker Qual	High
Product	pom	url	https://checkerframework.org/	Medium
Version	file	version	3.48.2	High
Version	Manifest	Bundle-Version	3.48.2	High
Version	Manifest	Implementation-Version	3.48.2	High
Version	pom	version	3.48.2	Highest

Identifiers

pkg:maven/org.checkerframework/checker-qual@3.48.2 (Confidence:High)

Description:

Error Prone is a static analysis tool for Java that catches common programming mistakes at compile-time.

License:

Apache 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\errorprone\error_prone_annotations\2.35.1\error_prone_annotations-2.35.1.jar
MD5: e017d8c88988d129e9076546a8d0a714
SHA1: c36f9e12192226278c2b163bf61990b131e59903
SHA256:03b63fee38e3a86fda311af5a0357e64eea44909aab5251ed178119270508ff5
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.98

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	error_prone_annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	errorprone	Highest
Vendor	jar	package name	google	Highest
Vendor	Manifest	build-jdk-spec	17	Low
Vendor	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Vendor	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	error_prone_annotations	Highest
Vendor	pom	artifactid	error_prone_annotations	Low
Vendor	pom	groupid	com.google.errorprone	Highest
Vendor	pom	name	error-prone annotations	High
Vendor	pom	parent-artifactid	error_prone_parent	Low
Product	file	name	error_prone_annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	errorprone	Highest
Product	jar	package name	google	Highest
Product	Manifest	build-jdk-spec	17	Low
Product	Manifest	bundle-docurl	https://errorprone.info/error_prone_annotations	Low
Product	Manifest	Bundle-Name	error-prone annotations	Medium
Product	Manifest	bundle-symbolicname	com.google.errorprone.annotations	Medium
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	error_prone_annotations	Highest
Product	pom	groupid	com.google.errorprone	Highest
Product	pom	name	error-prone annotations	High
Product	pom	parent-artifactid	error_prone_parent	Medium
Version	file	version	2.35.1	High
Version	Manifest	Bundle-Version	2.35.1	High
Version	pom	version	2.35.1	Highest

Identifiers

pkg:maven/com.google.errorprone/error_prone_annotations@2.35.1 (Confidence:High)

Description:

    A set of annotations that provide additional information to the J2ObjC
    translator to modify the result of translation.

License:

Apache License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\j2objc\j2objc-annotations\3.0.0\j2objc-annotations-3.0.0.jar
MD5: f59529b29202a5baf37f491ea5ec8627
SHA1: 7399e65dd7e9ff3404f4535b2f017093bdb134c7
SHA256:88241573467ddca44ffd4d74aa04c2bbfd11bf7c17e0c342c94c9de7a70a7c64
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.98

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	j2objc-annotations	High
Vendor	jar	package name	annotations	Highest
Vendor	jar	package name	google	Highest
Vendor	jar	package name	j2objc	Highest
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	j2objc-annotations	Highest
Vendor	pom	artifactid	j2objc-annotations	Low
Vendor	pom	developer email	tball@google.com	Low
Vendor	pom	developer id	tomball	Medium
Vendor	pom	developer name	Tom Ball	Medium
Vendor	pom	developer org	Google	Medium
Vendor	pom	developer org URL	https://www.google.com	Medium
Vendor	pom	groupid	com.google.j2objc	Highest
Vendor	pom	name	J2ObjC Annotations	High
Vendor	pom	url	google/j2objc/	Highest
Product	file	name	j2objc-annotations	High
Product	jar	package name	annotations	Highest
Product	jar	package name	google	Highest
Product	jar	package name	j2objc	Highest
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	j2objc-annotations	Highest
Product	pom	developer email	tball@google.com	Low
Product	pom	developer id	tomball	Low
Product	pom	developer name	Tom Ball	Low
Product	pom	developer org	Google	Low
Product	pom	developer org URL	https://www.google.com	Low
Product	pom	groupid	com.google.j2objc	Highest
Product	pom	name	J2ObjC Annotations	High
Product	pom	url	google/j2objc/	High
Version	file	version	3.0.0	High
Version	pom	version	3.0.0	Highest

Identifiers

pkg:maven/com.google.j2objc/j2objc-annotations@3.0.0 (Confidence:High)

Description:

JSR305 Annotations for Findbugs

License:

The Apache Software License, Version 2.0: http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\com\google\code\findbugs\jsr305\3.0.2\jsr305-3.0.2.jar
MD5: dd83accb899363c32b07d7a1b2e4ce40
SHA1: 25ea2e8b0c338a877313bd4672d3fe056ea78f0d
SHA256:766ad2a0783f2687962c8ad74ceecc38a28b9f72a2d085ee438b7813e928d0c7
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.spotbugs/spotbugs-annotations@4.8.6

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsr305	High
Vendor	Manifest	bundle-symbolicname	org.jsr-305	Medium
Vendor	pom	artifactid	jsr305	Highest
Vendor	pom	artifactid	jsr305	Low
Vendor	pom	groupid	com.google.code.findbugs	Highest
Vendor	pom	name	FindBugs-jsr305	High
Vendor	pom	url	http://findbugs.sourceforge.net/	Highest
Product	file	name	jsr305	High
Product	Manifest	Bundle-Name	FindBugs-jsr305	Medium
Product	Manifest	bundle-symbolicname	org.jsr-305	Medium
Product	pom	artifactid	jsr305	Highest
Product	pom	groupid	com.google.code.findbugs	Highest
Product	pom	name	FindBugs-jsr305	High
Product	pom	url	http://findbugs.sourceforge.net/	Medium
Version	file	version	3.0.2	High
Version	Manifest	Bundle-Version	3.0.2	High
Version	pom	version	3.0.2	Highest

Identifiers

pkg:maven/com.google.code.findbugs/jsr305@3.0.2 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.36\lombok-1.18.36.jar\lombok\launch\mavenEcjBootstrapAgent.jar
MD5: 27467519bf9615b24cad3b003c4353a9
SHA1: 37d92e0a726a67883ab94bee27c6f292e6318dcd
SHA256:9566d0706d6245cac3cdd9db6d1d81551aa3e727febcf64452c6db9701c40037
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	mavenEcjBootstrapAgent	High
Vendor	jar	package name	launch	Low
Vendor	jar	package name	lombok	Low
Vendor	Manifest	can-redefine-classes	true	Low
Product	file	name	mavenEcjBootstrapAgent	High
Product	jar	package name	launch	Low
Product	Manifest	can-redefine-classes	true	Low

Identifiers

None

Description:

Spice up your java: Automatic Resource Management, automatic generation of getters, setters, equals, hashCode and toString, and more!

License:

The MIT License: https://projectlombok.org/LICENSE

File Path: C:\Users\Jeremy\.m2\repository\org\projectlombok\lombok\1.18.36\lombok-1.18.36.jar
MD5: 92c08153ae16c161c8cc2cc8185d2724
SHA1: 5a30490a6e14977d97d9c73c924c1f1b5311ea95
SHA256:73b6b05b6a2d365b700bab08d30f94de9d336490bc0acce5b6181fef48cbf18e
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.98

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	lombok	High
Vendor	jar	package name	java	Highest
Vendor	jar	package name	lombok	Highest
Vendor	jar	package name	tostring	Highest
Vendor	Manifest	automatic-module-name	lombok	Medium
Vendor	Manifest	can-redefine-classes	true	Low
Vendor	pom	artifactid	lombok	Highest
Vendor	pom	artifactid	lombok	Low
Vendor	pom	developer email	reinier@projectlombok.org	Low
Vendor	pom	developer email	roel@projectlombok.org	Low
Vendor	pom	developer id	rspilker	Medium
Vendor	pom	developer id	rzwitserloot	Medium
Vendor	pom	developer name	Reinier Zwitserloot	Medium
Vendor	pom	developer name	Roel Spilker	Medium
Vendor	pom	groupid	org.projectlombok	Highest
Vendor	pom	name	Project Lombok	High
Vendor	pom	url	https://projectlombok.org	Highest
Product	file	name	lombok	High
Product	jar	package name	java	Highest
Product	jar	package name	lombok	Highest
Product	jar	package name	tostring	Highest
Product	Manifest	automatic-module-name	lombok	Medium
Product	Manifest	can-redefine-classes	true	Low
Product	pom	artifactid	lombok	Highest
Product	pom	developer email	reinier@projectlombok.org	Low
Product	pom	developer email	roel@projectlombok.org	Low
Product	pom	developer id	rspilker	Low
Product	pom	developer id	rzwitserloot	Low
Product	pom	developer name	Reinier Zwitserloot	Low
Product	pom	developer name	Roel Spilker	Low
Product	pom	groupid	org.projectlombok	Highest
Product	pom	name	Project Lombok	High
Product	pom	url	https://projectlombok.org	Medium
Version	file	version	1.18.36	High
Version	Manifest	lombok-version	1.18.36	Medium
Version	pom	version	1.18.36	Highest

Identifiers

pkg:maven/org.projectlombok/lombok@1.18.36 (Confidence:High)

File Path: C:\Users\Jeremy\.m2\repository\org\gaul\modernizer-maven-annotations\2.9.0\modernizer-maven-annotations-2.9.0.jar
MD5: 638a555dc0ff4c996e8a920215fc8ea4
SHA1: 4de00c50ce237cf7a721ffe907e11f0688538b04
SHA256:baeca9a46aae8dbe8075058726389112382bc60be811e70886fbaba57c68502f
Referenced In Project/Scope: tomcat9-config:provided
modernizer-maven-annotations-2.9.0.jar is in the transitive dependency tree of the listed items.Included by: pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.98

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	modernizer-maven-annotations	High
Vendor	jar	package name	gaul	Highest
Vendor	Manifest	build-jdk-spec	21	Low
Vendor	Manifest	multi-release	true	Low
Vendor	pom	artifactid	modernizer-maven-annotations	Highest
Vendor	pom	artifactid	modernizer-maven-annotations	Low
Vendor	pom	groupid	org.gaul	Highest
Vendor	pom	name	Modernizer Maven Plugin annotations	High
Vendor	pom	parent-artifactid	modernizer-maven-parent	Low
Product	file	name	modernizer-maven-annotations	High
Product	jar	package name	gaul	Highest
Product	Manifest	build-jdk-spec	21	Low
Product	Manifest	multi-release	true	Low
Product	pom	artifactid	modernizer-maven-annotations	Highest
Product	pom	groupid	org.gaul	Highest
Product	pom	name	Modernizer Maven Plugin annotations	High
Product	pom	parent-artifactid	modernizer-maven-parent	Medium
Version	file	version	2.9.0	High
Version	pom	version	2.9.0	Highest

Identifiers

pkg:maven/org.gaul/modernizer-maven-annotations@2.9.0 (Confidence:High)

Description:

Annotations the SpotBugs tool supports

License:

GNU LESSER GENERAL PUBLIC LICENSE, Version 2.1: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html

File Path: C:\Users\Jeremy\.m2\repository\com\github\spotbugs\spotbugs-annotations\4.8.6\spotbugs-annotations-4.8.6.jar
MD5: 0806b237c67c69869506ce3ced9a722f
SHA1: 1dcffed3e561ed32134a0dff4717f19bc2fdf4d8
SHA256:4548b74a815ed44f5480ca4f06204a8b00809dc7e5f6a825a9edf18f40377b65
Referenced In Project/Scope: tomcat9-config:provided
pkg:maven/com.github.hazendaz.tomcat/tomcat9-config@9.0.98

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	spotbugs-annotations	High
Vendor	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Vendor	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Vendor	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Vendor	pom	artifactid	spotbugs-annotations	Highest
Vendor	pom	artifactid	spotbugs-annotations	Low
Vendor	pom	developer email	andreas.sewe@codetrails.com	Low
Vendor	pom	developer email	dbrosius@mebigfatguy.com	Low
Vendor	pom	developer email	loskutov@gmx.de	Low
Vendor	pom	developer email	skypencil@gmail.com	Low
Vendor	pom	developer id	henrik242	Medium
Vendor	pom	developer id	iloveeclipse	Medium
Vendor	pom	developer id	jsotuyod	Medium
Vendor	pom	developer id	KengoTODA	Medium
Vendor	pom	developer id	mebigfatguy	Medium
Vendor	pom	developer id	sewe	Medium
Vendor	pom	developer id	ThrawnCA	Medium
Vendor	pom	developer name	Andreas Sewe	Medium
Vendor	pom	developer name	Andrey Loskutov	Medium
Vendor	pom	developer name	Dave Brosius	Medium
Vendor	pom	developer name	Juan Martín Sotuyo Dodero	Medium
Vendor	pom	developer name	Kengo TODA	Medium
Vendor	pom	groupid	com.github.spotbugs	Highest
Vendor	pom	name	SpotBugs Annotations	High
Vendor	pom	url	https://spotbugs.github.io/	Highest
Product	file	name	spotbugs-annotations	High
Product	Manifest	automatic-module-name	com.github.spotbugs.annotations	Medium
Product	Manifest	Bundle-Name	spotbugs-annotations	Medium
Product	Manifest	bundle-requiredexecutionenvironment	J2SE-1.5	Low
Product	Manifest	bundle-symbolicname	spotbugs-annotations	Medium
Product	pom	artifactid	spotbugs-annotations	Highest
Product	pom	developer email	andreas.sewe@codetrails.com	Low
Product	pom	developer email	dbrosius@mebigfatguy.com	Low
Product	pom	developer email	loskutov@gmx.de	Low
Product	pom	developer email	skypencil@gmail.com	Low
Product	pom	developer id	henrik242	Low
Product	pom	developer id	iloveeclipse	Low
Product	pom	developer id	jsotuyod	Low
Product	pom	developer id	KengoTODA	Low
Product	pom	developer id	mebigfatguy	Low
Product	pom	developer id	sewe	Low
Product	pom	developer id	ThrawnCA	Low
Product	pom	developer name	Andreas Sewe	Low
Product	pom	developer name	Andrey Loskutov	Low
Product	pom	developer name	Dave Brosius	Low
Product	pom	developer name	Juan Martín Sotuyo Dodero	Low
Product	pom	developer name	Kengo TODA	Low
Product	pom	groupid	com.github.spotbugs	Highest
Product	pom	name	SpotBugs Annotations	High
Product	pom	url	https://spotbugs.github.io/	Medium
Version	file	version	4.8.6	High
Version	Manifest	Bundle-Version	4.8.6	High
Version	pom	version	4.8.6	Highest

Identifiers

pkg:maven/com.github.spotbugs/spotbugs-annotations@4.8.6 (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\annotations-api.jar
MD5: bf3c4815991bb52f5b54d5ccc561a6aa
SHA1: c9e41dfed4acbcec727aa6a29932df413ba224b2
SHA256:a6451be75cbe373e79f30d626f199e77b70020bd164a23632e5f4f58eaffbaef
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	annotations-api	High
Vendor	jar	package name	annotation	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Vendor	manifest: javax/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/security/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/annotation/sql/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	annotations-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	annotation	Low
Product	jar	package name	javax	Highest
Product	jar	package name	security	Highest
Product	jar	package name	sql	Highest
Product	Manifest	Bundle-Name	tomcat-annotations-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-annotations-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaAnnotation;version:List="1.3,1.2,1.1,1";uses:="javax.annotation,javax.annotation.security,javax.annotation.sql"	Low
Product	manifest: javax/annotation/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/security/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/security/	Specification-Title	Common Annotations	Medium
Product	manifest: javax/annotation/sql/	Implementation-Title	javax.annotation	Medium
Product	manifest: javax/annotation/sql/	Specification-Title	Common Annotations	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	security	Highest
Version	jar	package name	sql	Highest
Version	Manifest	Bundle-Version	9.0.98	High
Version	manifest: javax/annotation/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/security/	Implementation-Version	1.3.FR	Medium
Version	manifest: javax/annotation/sql/	Implementation-Version	1.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\bin\bootstrap.jar
MD5: 02cc3e15406e558242a058830c6de98a
SHA1: be8d7110de8f13ac0ecda8cfcc52312443c71994
SHA256:6cb02004ce90fd4f59af6784e5416af6c0ef2de64d94e70af43569434922f014
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	bootstrap	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	startup	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	bootstrap	High
Product	jar	package name	apache	Highest
Product	jar	package name	bootstrap	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	startup	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Implementation-Title	Apache Tomcat Bootstrap	High
Product	Manifest	specification-title	Apache Tomcat Bootstrap	Medium
Version	Manifest	Implementation-Version	9.0.98	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\catalina-ant.jar
MD5: f80c6432f061604b4540e74f97d567c0
SHA1: 7f00b010cf78360337f06817b4c1ad32352b2028
SHA256:fdd1eb38e8b55f6c3fe5a0ec5a939d86e770a2542ae788d0dbeb68e04d05d041
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ant	High
Vendor	jar	package name	ant	Low
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Low
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ant	High
Product	jar	package name	ant	Low
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Low
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Implementation-Version	9.0.98	High

Identifiers

cpe:2.3:a:apache:ant:9.0.98:*:*:*:*:*:*:* (Confidence:High)
cpe:2.3:a:apache:tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:High)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\catalina-ha.jar
MD5: fb9aacf7d8417781c8a34f7d88b80244
SHA1: 81d9a3c52f64d610d289b94438c3adc8be8624d0
SHA256:51766258917da3ac02bcfdab690ee9c7fd17b719b2e27e926a1f06c596c6c6b1
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina-ha	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	ha	Highest
Vendor	jar	package name	ha	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina-ha	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	ha	Highest
Product	jar	package name	ha	Low
Product	Manifest	Bundle-Name	tomcat-catalina-ha	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina-ha	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.98	High
Version	Manifest	Implementation-Version	9.0.98	High

Related Dependencies

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\catalina.jar
MD5: 9294303ad3f4a038822729a2f1ae12ac
SHA1: cef7880f49e154aeaa30c4c2655d92a7cf17757b
SHA256:38940a585577dd145858648e849786602c847bac964569548319a3afe889dc87
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	catalina	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	catalina	Highest
Vendor	jar	package name	catalina	Low
Vendor	jar	package name	tomcat	Highest
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	catalina	High
Product	jar	package name	apache	Highest
Product	jar	package name	catalina	Highest
Product	jar	package name	catalina	Low
Product	jar	package name	tomcat	Highest
Product	Manifest	Bundle-Name	tomcat-catalina	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-catalina	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.98	High
Version	Manifest	Implementation-Version	9.0.98	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Highest)

Description:

    Apache Commons Daemon software is a set of utilities and Java support
    classes for running Java applications as server processes. These are
    commonly known as 'daemon' processes in Unix terminology (hence the
    name). On Windows they are called 'services'.

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\bin\commons-daemon.jar
MD5: fb4cdbbdb3ab0dc65b1c1928641b3aed
SHA1: cc65de9f1914a2a42e3868d15a341626cfdc1155
SHA256:6b8e35b13f27f265fed0caa7c4ce9d13b790662af5f48cb7d41df394de759dbd
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	commons-daemon	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	commons	Highest
Vendor	jar	package name	daemon	Highest
Vendor	jar	package name	support	Highest
Vendor	Manifest	build-jdk-spec	1.8	Low
Vendor	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Vendor	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Vendor	Manifest	Implementation-Vendor	The Apache Software Foundation	High
Vendor	Manifest	Implementation-Vendor-Id	org.apache	Medium
Vendor	Manifest	specification-vendor	The Apache Software Foundation	Low
Vendor	pom	artifactid	commons-daemon	Low
Vendor	pom	developer email	billbarker at apache.org	Low
Vendor	pom	developer email	ggregory at apache.org	Low
Vendor	pom	developer email	jfclere at apache.org	Low
Vendor	pom	developer email	mturk at apache.org	Low
Vendor	pom	developer email	pier at apache.org	Low
Vendor	pom	developer email	remm at apache.org	Low
Vendor	pom	developer email	yoavs at apache.org	Low
Vendor	pom	developer id	billbarker	Medium
Vendor	pom	developer id	ggregory	Medium
Vendor	pom	developer id	jfclere	Medium
Vendor	pom	developer id	mturk	Medium
Vendor	pom	developer id	pier	Medium
Vendor	pom	developer id	remm	Medium
Vendor	pom	developer id	yoavs	Medium
Vendor	pom	developer name	Bill Barker	Medium
Vendor	pom	developer name	Gary Gregory	Medium
Vendor	pom	developer name	Jean-Frederic Clere	Medium
Vendor	pom	developer name	Mladen Turk	Medium
Vendor	pom	developer name	Pier Fumagalli	Medium
Vendor	pom	developer name	Remy Maucherat	Medium
Vendor	pom	developer name	Yoav Shapira	Medium
Vendor	pom	developer org	The Apache Software Foundation	Medium
Vendor	pom	developer org URL	https://www.apache.org/	Medium
Vendor	pom	groupid	commons-daemon	Highest
Vendor	pom	name	Apache Commons Daemon	High
Vendor	pom	parent-artifactid	commons-parent	Low
Vendor	pom	parent-groupid	org.apache.commons	Medium
Vendor	pom	url	https://commons.apache.org/proper/commons-daemon/	Highest
Product	file	name	commons-daemon	High
Product	jar	package name	apache	Highest
Product	jar	package name	commons	Highest
Product	jar	package name	daemon	Highest
Product	jar	package name	support	Highest
Product	Manifest	build-jdk-spec	1.8	Low
Product	Manifest	bundle-docurl	https://commons.apache.org/proper/commons-daemon/	Low
Product	Manifest	Bundle-Name	Apache Commons Daemon	Medium
Product	Manifest	bundle-symbolicname	org.apache.commons.commons-daemon	Medium
Product	Manifest	Implementation-Title	Apache Commons Daemon	High
Product	Manifest	specification-title	Apache Commons Daemon	Medium
Product	pom	artifactid	commons-daemon	Highest
Product	pom	developer email	billbarker at apache.org	Low
Product	pom	developer email	ggregory at apache.org	Low
Product	pom	developer email	jfclere at apache.org	Low
Product	pom	developer email	mturk at apache.org	Low
Product	pom	developer email	pier at apache.org	Low
Product	pom	developer email	remm at apache.org	Low
Product	pom	developer email	yoavs at apache.org	Low
Product	pom	developer id	billbarker	Low
Product	pom	developer id	ggregory	Low
Product	pom	developer id	jfclere	Low
Product	pom	developer id	mturk	Low
Product	pom	developer id	pier	Low
Product	pom	developer id	remm	Low
Product	pom	developer id	yoavs	Low
Product	pom	developer name	Bill Barker	Low
Product	pom	developer name	Gary Gregory	Low
Product	pom	developer name	Jean-Frederic Clere	Low
Product	pom	developer name	Mladen Turk	Low
Product	pom	developer name	Pier Fumagalli	Low
Product	pom	developer name	Remy Maucherat	Low
Product	pom	developer name	Yoav Shapira	Low
Product	pom	developer org	The Apache Software Foundation	Low
Product	pom	developer org URL	https://www.apache.org/	Low
Product	pom	groupid	commons-daemon	Highest
Product	pom	name	Apache Commons Daemon	High
Product	pom	parent-artifactid	commons-parent	Medium
Product	pom	parent-groupid	org.apache.commons	Medium
Product	pom	url	https://commons.apache.org/proper/commons-daemon/	Medium
Version	Manifest	Bundle-Version	1.4.0	High
Version	Manifest	Implementation-Version	1.4.0	High
Version	pom	parent-version	1.4.0	Low
Version	pom	version	1.4.0	Highest

Identifiers

pkg:maven/commons-daemon/commons-daemon@1.4.0 (Confidence:High)
cpe:2.3:a:apache:apache_commons_daemon:1.4.0:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\ecj-4.20.jar
MD5: ee47966a67cd4019f1b8ccac74ba8dca
SHA1: 4837be609a3368a0f7e7cf0dc1bdbc7fe94993de
SHA256:ac0ba5876eaf7ebb47749a0d1be179c51f194b9dd0b875d1c09e1b530f5a2db5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	ecj	High
Vendor	jar	package name	compiler	Highest
Vendor	jar	package name	core	Highest
Vendor	jar	package name	eclipse	Highest
Vendor	jar	package name	eclipse	Low
Vendor	jar	package name	internal	Low
Vendor	jar	package name	jdt	Highest
Vendor	jar	package name	jdt	Low
Vendor	Manifest	build-jdk-spec	11	Low
Vendor	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Product	file	name	ecj	High
Product	jar	package name	compiler	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	core	Highest
Product	jar	package name	eclipse	Highest
Product	jar	package name	internal	Low
Product	jar	package name	jdt	Highest
Product	jar	package name	jdt	Low
Product	Manifest	build-jdk-spec	11	Low
Product	Manifest	Bundle-Name	Eclipse Compiler for Java(TM)	Medium
Product	Manifest	bundle-symbolicname	org.eclipse.jdt.core.compiler.batch	Medium
Version	file	name	ecj	Medium
Version	file	version	4.20	High
Version	Manifest	build-jdk-spec	11	Low
Version	Manifest	Bundle-Version	3.26.0.v20210609-0549	High

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\el-api.jar
MD5: a7baef6aa4913919fea25872740bf7e2
SHA1: f25cdef5efa34399fe3afbe08d0e34a09bad4657
SHA256:ff543f3000f31ba32e31369fd9bb93dab7fcea2352a1388a3635149e40617cd0
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	el-api	High
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	javax	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Vendor	manifest: javax/el/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	el-api	High
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expression	Highest
Product	jar	package name	javax	Highest
Product	Manifest	Bundle-Name	tomcat-el-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-el-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaEL;version:List="3.0,2.2,2.1";uses:="javax.el"	Low
Product	manifest: javax/el/	Implementation-Title	javax.el	Medium
Product	manifest: javax/el/	Specification-Title	Expression Language	Medium
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.98	High
Version	manifest: javax/el/	Implementation-Version	3.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:3.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-0493

Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow attackers to bypass intended restrictions.

CWE-254 7PK - Security Features

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
cve@mitre.org - MAILING_LIST
cve@mitre.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.3.2

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0044

Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a allow remote attackers to insert arbitrary web script or HTML.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2000-0760

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (6.4)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2000-0672

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

NVD-CWE-noinfo

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - BROKEN_LINK,EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY
cve@mitre.org - THIRD_PARTY_ADVISORY,VDB_ENTRY

Vulnerable Software & Versions: (show all)

CVE-2000-1210

Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the argument to source.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.1

CVE-2001-0590

Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 3.2.2

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0042

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0043

Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allow remote attackers to read portions of some files through the web.xml file.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2003-0045

Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource consumption) via a request for a JSP page containing an MS-DOS device name, such as aux.jsp.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-0808

Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
cve@mitre.org - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\jasper-el.jar
MD5: 755c945060d93ccd987754127597a7d5
SHA1: 5199d77f0691ea0a4301f8e15f419e4635587e76
SHA256:ec424c2a5df8ebe6df74a991b9f6ecec9d3edd64e967393a2d2384ef820be0b9
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper-el	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	el	Highest
Vendor	jar	package name	el	Low
Vendor	jar	package name	parser	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper-el	High
Product	jar	package name	apache	Highest
Product	jar	package name	el	Highest
Product	jar	package name	el	Low
Product	jar	package name	expressionfactoryimpl	Highest
Product	jar	package name	parser	Low
Product	Manifest	Bundle-Name	tomcat-jasper-el	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper-el	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	provide-capability	osgi.service;objectClass:List="javax.el.ExpressionFactory";effective:=active,osgi.serviceloader;osgi.serviceloader="javax.el.ExpressionFactory";register:="org.apache.el.ExpressionFactoryImpl"	Low
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	jar	package name	apache	Highest
Version	jar	package name	el	Highest
Version	jar	package name	expressionfactoryimpl	Highest
Version	Manifest	Bundle-Version	9.0.98	High
Version	Manifest	Implementation-Version	9.0.98	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\jasper.jar
MD5: 96b04721a80b8cc9ca55e08820e32bfb
SHA1: 704ebb292d4b7caaaf3a02630ad4b64c9c2b0f9f
SHA256:27570e826e3fa49ddcc87272195d8ee4547ab7a24234026a818e9a292e5c1d92
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jasper	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	compiler	Low
Vendor	jar	package name	jasper	Highest
Vendor	jar	package name	jasper	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	jasper	High
Product	jar	package name	apache	Highest
Product	jar	package name	compiler	Low
Product	jar	package name	jasper	Highest
Product	jar	package name	jasper	Low
Product	Manifest	Bundle-Name	tomcat-jasper	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jasper	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.98	High
Version	Manifest	Implementation-Version	9.0.98	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\jaspic-api.jar
MD5: 8430877501dc0297066e6bc4bd591b79
SHA1: dba5f253857ac78c7c662045e6ff928e4ed1164e
SHA256:ed86720164028eab4bf0cc350199d441ef928943b68bb7f12a40671d285af3b9
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jaspic-api	High
Vendor	jar	package name	auth	Low
Vendor	jar	package name	javax	Low
Vendor	jar	package name	security	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Vendor	manifest: javax/security/auth/message/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/callback/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/config/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/security/auth/message/module/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jaspic-api	High
Product	jar	package name	auth	Highest
Product	jar	package name	auth	Low
Product	jar	package name	javax	Highest
Product	jar	package name	message	Highest
Product	jar	package name	message	Low
Product	jar	package name	security	Highest
Product	jar	package name	security	Low
Product	Manifest	Bundle-Name	tomcat-jaspic-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jaspic-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJASPIC;version:List="1.1,1";uses:="javax.security.auth.message,javax.security.auth.message.callback,javax.security.auth.message.config,javax.security.auth.message.module"	Low
Product	manifest: javax/security/auth/message/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/callback/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/callback/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/config/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/config/	Specification-Title	Java Authentication SPI for Containers	Medium
Product	manifest: javax/security/auth/message/module/	Implementation-Title	javax.security.auth.message	Medium
Product	manifest: javax/security/auth/message/module/	Specification-Title	Java Authentication SPI for Containers	Medium
Version	jar	package name	auth	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	message	Highest
Version	jar	package name	security	Highest
Version	Manifest	Bundle-Version	9.0.98	High
Version	manifest: javax/security/auth/message/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/callback/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/config/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/security/auth/message/module/	Implementation-Version	1.1.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\jsp-api.jar
MD5: b3fed7d9c9b8946e93a865a4c4887f57
SHA1: d8edc71b0f6e45881b6a85a2f40ad59ab5fc806b
SHA256:e5b9202bdb53f1f36a1263a8697ca27e7aa2dfd5bca0e1e8c4f18f2e62e6f3fd
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	jsp-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	jsp	Highest
Vendor	jar	package name	jsp	Low
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Vendor	manifest: javax/servlet/jsp/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/el/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/jsp/tagext/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	jsp-api	High
Product	jar	package name	el	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	jsp	Highest
Product	jar	package name	jsp	Low
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	jar	package name	tagext	Highest
Product	Manifest	Bundle-Name	tomcat-jsp-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-jsp-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaJSP;version:List="2.3,2.2,2.1,2";uses:="javax.servlet.jsp,javax.servlet.jsp.el,javax.servlet.jsp.resources,javax.servlet.jsp.tagext"	Low
Product	manifest: javax/servlet/jsp/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/el/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/el/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/resources/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/resources/	Specification-Title	Java API for JavaServer Pages	Medium
Product	manifest: javax/servlet/jsp/tagext/	Implementation-Title	javax.servlet.jsp	Medium
Product	manifest: javax/servlet/jsp/tagext/	Specification-Title	Java API for JavaServer Pages	Medium
Version	jar	package name	el	Highest
Version	jar	package name	javax	Highest
Version	jar	package name	servlet	Highest
Version	jar	package name	tagext	Highest
Version	Manifest	Bundle-Version	9.0.98	High
Version	manifest: javax/servlet/jsp/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/el/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/resources/	Implementation-Version	2.3.FR	Medium
Version	manifest: javax/servlet/jsp/tagext/	Implementation-Version	2.3.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\webapps\docs\appdev\sample\sample.war
MD5: 570f196c4a1025a717269d16d11d6f37
SHA1: 80f5053b166c69d81697ba21113c673f8372aca0
SHA256:89b33caa5bf4cfd235f060c396cb1a5acb2734a1366db325676f48c5f5ed92e5
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	sample	High
Vendor	jar	package name	classes	Low
Vendor	jar	package name	mypackage	Low
Vendor	jar	package name	web-inf	Low
Product	file	name	sample	High
Product	jar	package name	classes	Low
Product	jar	package name	hello	Low
Product	jar	package name	mypackage	Low

Identifiers

None

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\servlet-api.jar
MD5: 96fb550f5953f6b9401fde7d14f5683d
SHA1: a06c4f0ed3fddcdd1c634ebf472228706c29ea7f
SHA256:18085e7d8ad007c28bc50018437828fb6b88f65fabd774a1e4e6e8fbd2b7d757
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	servlet-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	servlet	Highest
Vendor	jar	package name	servlet	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Vendor	manifest: javax/servlet/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/annotation/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/descriptor/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/http/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/servlet/resources/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	servlet-api	High
Product	jar	package name	annotation	Highest
Product	jar	package name	descriptor	Highest
Product	jar	package name	http	Highest
Product	jar	package name	javax	Highest
Product	jar	package name	servlet	Highest
Product	jar	package name	servlet	Low
Product	Manifest	Bundle-Name	tomcat-servlet-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-servlet-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaServlet;version:List="4.0,3.1,3,2.5";uses:="javax.servlet,javax.servlet.annotation,javax.servlet.descriptor,javax.servlet.http,javax.servlet.resources"	Low
Product	manifest: javax/servlet/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/annotation/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/annotation/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/descriptor/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/descriptor/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/http/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/http/	Specification-Title	Java API for Servlets	Medium
Product	manifest: javax/servlet/resources/	Implementation-Title	javax.servlet	Medium
Product	manifest: javax/servlet/resources/	Specification-Title	Java API for Servlets	Medium
Version	jar	package name	annotation	Highest
Version	jar	package name	descriptor	Highest
Version	jar	package name	http	Highest
Version	jar	package name	javax	Highest
Version	Manifest	Bundle-Version	9.0.98	High
Version	manifest: javax/servlet/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/annotation/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/descriptor/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/http/	Implementation-Version	4.0.FR	Medium
Version	manifest: javax/servlet/resources/	Implementation-Version	4.0.FR	Medium

Identifiers

cpe:2.3:a:apache:tomcat:4.0.0:*:*:*:*:*:*:* (Confidence:Medium)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)

Published Vulnerabilities

CVE-2016-8735

CISA Known Exploited Vulnerability:

Product: Apache Tomcat
Name: Apache Tomcat Remote Code Execution Vulnerability
Date Added: 2023-05-12
Description: Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.
Required Action: Apply updates per vendor instructions.
Due Date: 2023-06-02
Notes: https://tomcat.apache.org/security-9.html; https://nvd.nist.gov/vuln/detail/CVE-2016-8735

Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

NVD-CWE-noinfo

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSSv3:

Base Score: CRITICAL (9.8)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,PATCH
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - RELEASE_NOTES,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY
security@apache.org - MAILING_LIST,MITIGATION,THIRD_PARTY_ADVISORY
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,PATCH
security@apache.org - MAILING_LIST,THIRD_PARTY_ADVISORY
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - PATCH,THIRD_PARTY_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - RELEASE_NOTES,VENDOR_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY
security@apache.org - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2272

Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

CVSSv2:

Base Score: HIGH (7.8)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:C

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
cve@mitre.org - EXPLOIT,PATCH
cve@mitre.org - PATCH

Vulnerable Software & Versions: (show all)

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CWE-276 Incorrect Default Permissions

CVSSv2:

Base Score: HIGH (7.2)
Vector: /AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSSv3:

Base Score: HIGH (7.8)
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.8/RC:R/MAV:A

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,VENDOR_ADVISORY
meissner@suse.de - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
meissner@suse.de - MAILING_LIST,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1394

Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code for server files or bypass certain protections, a variant of CAN-2002-1148.

NVD-CWE-Other

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2009-3548

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

CWE-255 Credentials Management Errors

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-2185

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186.  NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue

CWE-20 Improper Input Validation

CVSSv2:

Base Score: HIGH (7.5)
Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4444

Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.

CWE-94 Improper Control of Generation of Code ('Code Injection')

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2013-6357

Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that "the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.

CWE-352 Cross-Site Request Forgery (CSRF)

CVSSv2:

Base Score: MEDIUM (6.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2013-4286

Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (5.8)
Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-1148

The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2002-2006

The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
cve@mitre.org - EXPLOIT
cve@mitre.org - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2003-0866

The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
cve@mitre.org - EXPLOIT,PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY
cve@mitre.org - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-0128

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

CWE-16 Configuration

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - PATCH
cve@mitre.org - VENDOR_ADVISORY
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.20

CVE-2014-0075

Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 allows remote attackers to cause a denial of service (resource consumption) via a malformed chunk size in chunked transfer coding of a request during the streaming of data.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (5.0)
Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2005-4838

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 5.5.6

CVE-2006-7196

Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2007-1355

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,PATCH
secalert@redhat.com - EXPLOIT,PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-2449

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
secalert@redhat.com - PATCH

Vulnerable Software & Versions: (show all)

CVE-2007-3383

Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail/sendmail.jsp) in Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.36 allows remote attackers to inject arbitrary web script or HTML via the From field and possibly other fields, related to generation of error messages.

NVD-CWE-Other

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH
af854a3a-2127-422b-91ae-364da2661108 - PATCH,US_GOVERNMENT_RESOURCE
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH
secalert@redhat.com - PATCH,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions: (show all)

CVE-2008-2938

Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - BROKEN_LINK
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - TOOL_SIGNATURE
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - BROKEN_LINK
secalert@redhat.com - MAILING_LIST,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - TOOL_SIGNATURE
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2009-2696

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
cve@mitre.org - ISSUE_TRACKING
cve@mitre.org - VENDOR_ADVISORY

Vulnerable Software & Versions:

cpe:2.3:a:apache:tomcat:*:*:*:*:*:*:*:* versions up to (including) 4.1.39

CVE-2013-4322

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.

CWE-20 Improper Input Validation

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:N/A:P

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2013-4590

Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, *.jspx, *.tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - ISSUE_TRACKING
af854a3a-2127-422b-91ae-364da2661108 - MAILING_LIST
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - THIRD_PARTY_ADVISORY,VDB_ENTRY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - ISSUE_TRACKING
secalert@redhat.com - MAILING_LIST
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - PERMISSIONS_REQUIRED,THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY
secalert@redhat.com - THIRD_PARTY_ADVISORY,VDB_ENTRY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0096

java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4 does not properly restrict XSLT stylesheets, which allows remote attackers to bypass security-manager restrictions and read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0099

Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.53, and 8.x before 8.0.4, when operated behind a reverse proxy, allows remote attackers to conduct HTTP request smuggling attacks via a crafted Content-Length HTTP header.

CWE-189 Numeric Errors

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2014-0119

Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.

CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:

Base Score: MEDIUM (4.3)
Vector: /AV:N/AC:M/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-2450

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - PATCH,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - PATCH,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2007-5461

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv2:

Base Score: LOW (3.5)
Vector: /AV:N/AC:M/Au:S/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT
secalert@redhat.com - EXPLOIT

Vulnerable Software & Versions: (show all)

CVE-2007-1358

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:N/I:P/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

CVE-2008-5519

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CVSSv2:

Base Score: LOW (2.6)
Vector: /AV:N/AC:H/Au:N/C:P/I:N/A:N

References:

af854a3a-2127-422b-91ae-364da2661108 - EXPLOIT,VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
af854a3a-2127-422b-91ae-364da2661108 - VENDOR_ADVISORY
secalert@redhat.com - EXPLOIT,VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY
secalert@redhat.com - VENDOR_ADVISORY

Vulnerable Software & Versions: (show all)

Description:

        An implementation of the JSP Standard Tag Library (JSTL).

License:

http://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\webapps\examples\WEB-INF\lib\taglibs-standard-impl-1.2.5.jar
MD5: 8e5c8db242fbef3db1acfcbb3bc8ec8b
SHA1: 9b9783ccb2a323383e6e20e36d368f8997b71967
SHA256:d075cb77d94e2d115b4d90a897b57d65cc31ed8e1b95d65361da324642705728
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	taglibs-standard-impl	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	standard	Highest
Vendor	jar	package name	tag	Highest
Vendor	jar	package name	taglibs	Highest
Vendor	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Vendor	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Vendor	pom	artifactid	taglibs-standard-impl	Low
Vendor	pom	developer name	Bjorn Townsend	Medium
Vendor	pom	developer name	Dmitri Plotnikov	Medium
Vendor	pom	developer name	Felipe Leme	Medium
Vendor	pom	developer name	Glenn Nielsen	Medium
Vendor	pom	developer name	Hans Bergsten	Medium
Vendor	pom	developer name	Henri Yandell	Medium
Vendor	pom	developer name	Jan Luehe	Medium
Vendor	pom	developer name	Justyna Horwat	Medium
Vendor	pom	developer name	Mark Kolb	Medium
Vendor	pom	developer name	Nathan Abramson	Medium
Vendor	pom	developer name	Pierre Delisle	Medium
Vendor	pom	developer name	Scott Hasse	Medium
Vendor	pom	developer name	Shawn Bayern	Medium
Vendor	pom	groupid	org.apache.taglibs	Highest
Vendor	pom	name	Apache Standard Taglib Implementation	High
Vendor	pom	parent-artifactid	taglibs-standard	Low
Product	file	name	taglibs-standard-impl	High
Product	jar	package name	apache	Highest
Product	jar	package name	standard	Highest
Product	jar	package name	tag	Highest
Product	jar	package name	taglibs	Highest
Product	Manifest	bundle-docurl	http://tomcat.apache.org/taglibs/standard-1.2.5/taglibs-standard-impl	Low
Product	Manifest	Bundle-Name	Apache Standard Taglib Implementation	Medium
Product	Manifest	bundle-symbolicname	org.apache.taglibs.standard-impl	Medium
Product	Manifest	Implementation-Title	Apache Standard Taglib Implementation	High
Product	pom	artifactid	taglibs-standard-impl	Highest
Product	pom	developer name	Bjorn Townsend	Low
Product	pom	developer name	Dmitri Plotnikov	Low
Product	pom	developer name	Felipe Leme	Low
Product	pom	developer name	Glenn Nielsen	Low
Product	pom	developer name	Hans Bergsten	Low
Product	pom	developer name	Henri Yandell	Low
Product	pom	developer name	Jan Luehe	Low
Product	pom	developer name	Justyna Horwat	Low
Product	pom	developer name	Mark Kolb	Low
Product	pom	developer name	Nathan Abramson	Low
Product	pom	developer name	Pierre Delisle	Low
Product	pom	developer name	Scott Hasse	Low
Product	pom	developer name	Shawn Bayern	Low
Product	pom	groupid	org.apache.taglibs	Highest
Product	pom	name	Apache Standard Taglib Implementation	High
Product	pom	parent-artifactid	taglibs-standard	Medium
Version	file	version	1.2.5	High
Version	Manifest	Bundle-Version	1.2.5	High
Version	Manifest	Implementation-Version	1.2.5	High
Version	pom	version	1.2.5	Highest

Related Dependencies

Identifiers

pkg:maven/org.apache.taglibs/taglibs-standard-impl@1.2.5 (Confidence:High)
cpe:2.3:a:apache:standard_taglibs:1.2.5:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-api.jar
MD5: 40cbac18b278b92c5d6cfda3d7ebb571
SHA1: 65960a79df8b5964daff12236ec2ebb6f735ca73
SHA256:aceb51aa60ec00156a471010fe413ae3e517c3c04cd2515e1b629f744a12e7cd
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-api	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	tomcat	Highest
Vendor	jar	package name	tomcat	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-api	High
Product	jar	package name	apache	Highest
Product	jar	package name	tomcat	Highest
Product	jar	package name	tomcat	Low
Product	Manifest	Bundle-Name	tomcat-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-api	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.98	High
Version	Manifest	Implementation-Version	9.0.98	High

Related Dependencies

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-coyote-ffm.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-coyote-ffm.jar
- MD5: b408faf484db9ed6133feb392bb79f16
- SHA1: ee5ef38a881d9f7ab27cbe675a0d76ad7c325f3a
- SHA256: 80463caea64b59529b757dc71d244746feebb8dd95a49fae061e582a4c9128ae
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-coyote.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-coyote.jar
- MD5: d89bb99020c41375bd03044f229cd546
- SHA1: e1ef3298a8ccc5a6ba763887d4af06d0b941a5e3
- SHA256: 00cbadbf34e43bb6597dbdc68f007956df634c3e5318f5e5e0a3cd4bc298b6c1
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-dbcp.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-dbcp.jar
- MD5: e19fbf820aaf0dc5f61ce4cdec9248da
- SHA1: 6326d620881da64ad15724a621475c5199f5b1a2
- SHA256: cc20d3e060e9cc0ce74b1ec23f83ff9f7d3a48a3109b4e236f9a3285aaddcec6
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-jdbc.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-jdbc.jar
- MD5: 2a6b4832636c59f065cbe8128c1d10df
- SHA1: 46beecc715aa373efe3d10e3a1849d759df55e38
- SHA256: f99335a60cfc374f8587b33bb5460a1f55f086f40c3178548a1773fca47bd87d
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-jni.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-jni.jar
- MD5: fdac694b25c0fbf559a9b251f63073f4
- SHA1: c5604e2970f218e18400487239fa65db36225510
- SHA256: e084af31c187f37f7397c57d5c0e64e4d96daaaccd00ed0bb4904def4022ec34
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-util-scan.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-util-scan.jar
- MD5: 10547eacdd82d00c9aad55eb9892dfe3
- SHA1: 9e7cbc6814ba43063d4049c9b3f68704f6aa83b5
- SHA256: e913f286446c267c92923b1432f248a052cf3fef4138db05e0108795b8f2cf69
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-util.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-util.jar
- MD5: b5d2d8b86024c5170eb0bc04e7bfec33
- SHA1: 197d106c0d9b399c6023fe20d3a8f764595ce064
- SHA256: 53b1cc1957bf977a6c148d1616e2db98cf61fb457104e83a28c8c5b76317d810

Identifiers

cpe:2.3:a:apache:tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Highest)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Highest)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-i18n-cs.jar
MD5: 684d1abae339e7455f035999adc8e763
SHA1: f61d7a1c3bff29e431c82c23ec7ba0edcc1aa032
SHA256:c1dc48bc2cc4a5ceac7a8c75e833ae66321a1debb9370de246172edffdb6b768
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-cs	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-cs	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-cs	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.98	High

Related Dependencies

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-i18n-de.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-i18n-de.jar
- MD5: 5242f4f791738f5aed68c8734617d01b
- SHA1: 0fb7d8998adf0341ce20b17bfaf0a064e900a0fc
- SHA256: 72b7b65235a36a22c496af46c4a5cc3e75ab56ac22d35dc5fb3a884e2097f804
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-i18n-es.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-i18n-es.jar
- MD5: 8b391ab3670d463dbe39a693062b222d
- SHA1: 3e68e80b5d86af8e782aec2b731177847c001e9f
- SHA256: 381adcf8a6225ef71cbb6a4edb0e4588f3ddac165da1a66150fdff10c0a17b16
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-i18n-ja.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-i18n-ja.jar
- MD5: 40375f12a380f86abdae55c41dcaba4e
- SHA1: 24c1e70ebcdaf56a562524786d4cecfeb95fd2c0
- SHA256: 5e38b8ae7cbbac248dbcf9e94ddf4ca5e5abb3889c9cc0051583906c531d239a
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-i18n-ko.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-i18n-ko.jar
- MD5: d63c083d914f7837919e8a038b8ff2c3
- SHA1: 2a7f3f0344ef6ea025675fa8fcec8893522185dc
- SHA256: 61c9bf638b88cab8f641e0287a4eb04f887bd36fbca91bfec5ce0c413ad0eb27
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-i18n-pt-BR.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-i18n-pt-BR.jar
- MD5: 349a0b2b61c363ca9afea634035c339b
- SHA1: fd53a8f239ed11183c1835ab3b3cf2d1b5c5981a
- SHA256: 276b71eb01c0c48d16014f2b5377112dd55c4070c05b259c2ec904b9be0bf4b1
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-i18n-ru.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-i18n-ru.jar
- MD5: d431fd8f5384080008e0c8e049078f7e
- SHA1: a4531773483d99611b6c6c24e4d0ca29e8812f68
- SHA256: 6e0a3c1c07cdb7238705f9c0e7528aabf7a21541936df856c3ddc780e5579d39
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-i18n-zh-CN.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-i18n-zh-CN.jar
- MD5: a3da687eacead0f3abf622e8c9579370
- SHA1: c66101c2ecc3d437f6d01d1d6a413d54cd3d7a6e
- SHA256: 4ad9d71b64194c3a5ba206a95c1c0094d641c7b97de9ffbf0ad981b968fc322b
tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-websocket.jar
- File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-websocket.jar
- MD5: dfe0c8195d122bcab93bb487d30f2b13
- SHA1: 8aa9b77eb56d2168f3c048f6ac56f6092f9085bb
- SHA256: ba0363b946bfde37eeca827bf3d94b8c11fb94b9330ddab818e33ff4b3a55c65

Identifiers

cpe:2.3:a:apache:tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\tomcat-i18n-fr.jar
MD5: 6094fbe8a9fc8a350e9fb8eaa8a83980
SHA1: 32a7d25825f28d676f702e0b5fed0632a4e98494
SHA256:ebe2e781d79faf193e1197032114bae21cab3947ec8e0f7188dff96c5dd6030d
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-i18n-fr	High
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-i18n-fr	High
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	file	name	tomcat-i18n-fr	Medium
Version	file	version	18	Medium
Version	Manifest	Implementation-Version	9.0.98	High

Identifiers

cpe:2.3:a:apache:tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Low)
cpe:2.3:a:nfr:nfr:9.0.98:*:*:*:*:*:*:* (Confidence:Low)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\bin\tomcat-juli.jar
MD5: 445547c31e2e79558a4517c78eb4d789
SHA1: 5b1fff24037339fcf8045f87ff5694b04e79c472
SHA256:40994df9c4741eefe7f38701be3c59e563bff89f030ca68b625a57e8ce149092
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	tomcat-juli	High
Vendor	jar	package name	apache	Highest
Vendor	jar	package name	apache	Low
Vendor	jar	package name	juli	Highest
Vendor	jar	package name	juli	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Vendor	Manifest	Implementation-Vendor	Apache Software Foundation	High
Vendor	Manifest	specification-vendor	Apache Software Foundation	Low
Product	file	name	tomcat-juli	High
Product	jar	package name	apache	Highest
Product	jar	package name	juli	Highest
Product	jar	package name	juli	Low
Product	Manifest	Bundle-Name	tomcat-juli	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-juli	Medium
Product	Manifest	Implementation-Title	Apache Tomcat	High
Product	Manifest	specification-title	Apache Tomcat	Medium
Version	Manifest	Bundle-Version	9.0.98	High
Version	Manifest	Implementation-Version	9.0.98	High

Identifiers

cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.98:*:*:*:*:*:*:* (Confidence:Highest)

License:

https://www.apache.org/licenses/LICENSE-2.0.txt

File Path: C:\Users\Jeremy\.m2\repository\org\apache\tomcat\tomcat\9.0.98\tomcat-9.0.98.tar.gz\tomcat-9.0.98.tar\apache-tomcat-9.0.98\lib\websocket-api.jar
MD5: c9d07cba101b5abd23bc6f0f386280f6
SHA1: 26a49b7f281dc2ab30375028834d277bb235195a
SHA256:d08510d7bd35cfdcd9b905d15a7c424bc393268853ea4a39beef8009f0111693
Referenced In Project/Scope: tomcat9-config:provided

Evidence

Type	Source	Name	Value	Confidence
Vendor	file	name	websocket-api	High
Vendor	jar	package name	javax	Low
Vendor	jar	package name	websocket	Highest
Vendor	jar	package name	websocket	Low
Vendor	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Vendor	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Vendor	manifest: javax/websocket/	Implementation-Vendor	Apache Software Foundation	Medium
Vendor	manifest: javax/websocket/server/	Implementation-Vendor	Apache Software Foundation	Medium
Product	file	name	websocket-api	High
Product	jar	package name	javax	Highest
Product	jar	package name	server	Highest
Product	jar	package name	websocket	Highest
Product	jar	package name	websocket	Low
Product	Manifest	Bundle-Name	tomcat-websocket-api	Medium
Product	Manifest	bundle-symbolicname	org.apache.tomcat-websocket-api	Medium
Product	Manifest	provide-capability	osgi.contract;osgi.contract=JavaWebSockets;version:List="1.1,1";uses:="javax.websocket,javax.websocket.server"	Low
Product	manifest: javax/websocket/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/	Specification-Title	WebSocket	Medium
Product	manifest: javax/websocket/server/	Implementation-Title	javax.websocket	Medium
Product	manifest: javax/websocket/server/	Specification-Title	WebSocket	Medium
Version	jar	package name	javax	Highest
Version	jar	package name	server	Highest
Version	Manifest	Bundle-Version	9.0.98	High
Version	manifest: javax/websocket/	Implementation-Version	1.1.FR	Medium
Version	manifest: javax/websocket/server/	Implementation-Version	1.1.FR	Medium

Identifiers

None

How to read the report | Suppressing false positives | Getting Help: github issues Sponsor

Project: tomcat9-config

com.github.hazendaz.tomcat:tomcat9-config:9.0.98

Summary

Dependencies (vulnerable)

checker-qual-3.48.2.jar

Evidence

Identifiers

error_prone_annotations-2.35.1.jar

Evidence

Identifiers

j2objc-annotations-3.0.0.jar

Evidence

Identifiers

jsr305-3.0.2.jar

Evidence

Identifiers

lombok-1.18.36.jar: mavenEcjBootstrapAgent.jar

Evidence

Identifiers

lombok-1.18.36.jar

Evidence

Identifiers

modernizer-maven-annotations-2.9.0.jar

Evidence

Identifiers

spotbugs-annotations-4.8.6.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: annotations-api.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: bootstrap.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: catalina-ant.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: catalina-ha.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: catalina.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: commons-daemon.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: ecj-4.20.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: el-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: jasper-el.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: jasper.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: jaspic-api.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: jsp-api.jar

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: sample.war

Evidence

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: servlet-api.jar

Evidence

Identifiers

Published Vulnerabilities

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: taglibs-standard-impl-1.2.5.jar

Evidence

Related Dependencies

Identifiers

tomcat-9.0.98.tar.gz: tomcat-9.0.98.tar: tomcat-api.jar

Evidence

How to read the report | Suppressing false positives | Getting Help: github issues

Sponsor