jetlib.sec » Tags » tomcat

Feeds

133445 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

266 items tagged "tomcat"

Related tags: security weaknesses [+], protocol security [+], hash [+], constraint [+], ajp [+], sendfile [+], red [+], parameter [+], memoryuserdatabase [+], manager interface [+], html [+], request [+], xml parser [+], xml [+], web [+], security constraints [+], manager [+], information [+], cross site scripting [+], bypass [+], application [+], sort [+], orderby [+], max [+], hat [+], enterprise web server [+], authentication header [+], windows [+], tomcat windows [+], requestdispatcher [+], request object [+], privilege [+], object security [+], escalation [+], information disclosure vulnerability [+], denial of service [+], web application [+], vulnerability analysis [+], user [+], ubuntu [+], tomcat tomcat [+], server request [+], security manager [+], safer use [+], request parameters [+], replay [+], privilege escalation vulnerability [+], pipelining [+], outofmemoryerror [+], oracle [+], nmap [+], meta data [+], memory leak [+], mandriva linux [+], jvm [+], jmx [+], jboss [+], form [+], file permissions [+], exploit [+], error message [+], dsa [+], disclosure [+], dictionary attack [+], denial [+], combinations [+], brute [+], available memory [+], attacker [+], apr [+], vulnerability [+], service vulnerability [+], tomcat java [+], tomcat 4 [+], ssl [+], java [+], hp ux [+], drop [+], daemon [+], daemokn [+], cookie [+], commons [+], command execution [+], cipher [+], capabilities [+], bugtraq [+], awstats [+], arbitrary command [+], security [+], http [+], apache tomcat [+], information disclosure [+], apache [+], webdav [+], utf [+], usn [+], tomcat jsp [+], talk [+], site [+], servletsecurity [+], service security [+], security vulnerability [+], owasp [+], nbsp [+], mdvsa [+], manager application [+], language [+], jsp example [+], jsp [+], cve [+], bsides [+], atlanta [+], annotations [+], Pentesting [+], vulnerabilities [+], digest authentication [+], red hat security [+], directory traversal vulnerability [+], javaserver pages technologies [+], hash collision [+], nio [+], directory [+], authentication [+], war [+], securitymanager [+], encoding [+], txt, traversal, jsp application, httpservletresponse, host manager, host

• May 22, 2012
• 0:00

  Vuln: Apache Tomcat Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Hash Collision Denial Of Service Vulnerability

  Tags:  tomcat hash apache hash-collision apache-tomcat service-vulnerability  

• 0:00

  Vuln: Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

  Tags:  memoryuserdatabase tomcat apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Parameter Handling Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Parameter Handling Denial of Service Vulnerability

  Tags:  parameter tomcat apache apache-tomcat service-vulnerability denial-of-service  

• 0:00

  Vuln: Apache Tomcat Request Object Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Request Object Security Bypass Vulnerability

  Tags:  request tomcat apache apache-tomcat object-security request-object  

• May 21, 2012
• 17:21

  Red Hat Security Advisory 2012-0682-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2012-0682-01 - Apache Tomcat is a servlet container. JBoss Enterprise Web Server includes the Tomcat Native library, providing Apache Portable Runtime support for Tomcat. This update fixes the JBPAPP-4873, JBPAPP-6133, and JBPAPP-6852 bugs. It also addresses multiple flaws that weakened the Tomcat HTTP DIGEST authentication implementation, subjecting it to some of the weaknesses of HTTP BASIC authentication, for example, allowing remote attackers to perform session replay attacks.

  Tags:  tomcat hat red enterprise-web-server apache-tomcat red-hat-security  

• 17:21

  Red Hat Security Advisory 2012-0682-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-0682-01 - Apache Tomcat is a servlet container. JBoss Enterprise Web Server includes the Tomcat Native library, providing Apache Portable Runtime support for Tomcat. This update fixes the JBPAPP-4873, JBPAPP-6133, and JBPAPP-6852 bugs. It also addresses multiple flaws that weakened the Tomcat HTTP DIGEST authentication implementation, subjecting it to some of the weaknesses of HTTP BASIC authentication, for example, allowing remote attackers to perform session replay attacks.

  Tags:  tomcat hat red enterprise-web-server apache-tomcat red-hat-security  

• 17:21

  Red Hat Security Advisory 2012-0682-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0682-01 - Apache Tomcat is a servlet container. JBoss Enterprise Web Server includes the Tomcat Native library, providing Apache Portable Runtime support for Tomcat. This update fixes the JBPAPP-4873, JBPAPP-6133, and JBPAPP-6852 bugs. It also addresses multiple flaws that weakened the Tomcat HTTP DIGEST authentication implementation, subjecting it to some of the weaknesses of HTTP BASIC authentication, for example, allowing remote attackers to perform session replay attacks.

  Tags:  tomcat hat red enterprise-web-server apache-tomcat red-hat-security  

• 17:20

  Red Hat Security Advisory 2012-0680-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2012-0680-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. JBoss Enterprise Web Server includes the Tomcat Native library, providing Apache Portable Runtime support for Tomcat. This update includes bug fixes as documented in JBPAPP-4873 and JBPAPP-6133.

  Tags:  tomcat hat red javaserver-pages-technologies enterprise-web-server apache-tomcat  

• 17:20

  Red Hat Security Advisory 2012-0680-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0680-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. JBoss Enterprise Web Server includes the Tomcat Native library, providing Apache Portable Runtime support for Tomcat. This update includes bug fixes as documented in JBPAPP-4873 and JBPAPP-6133.

  Tags:  tomcat hat red javaserver-pages-technologies enterprise-web-server apache-tomcat  

• April 27, 2012
• 5:30

  From LOW to PWNED [3] JBoss/Tomcat server-status

   » ‎ Carnal0wnage
  
  Several (tm) months back I did my talk on "From LOW to PWNED" at hashdays and BSides Atlanta.
  
  The slides were published here and the video from hashdays is here, no video for BSides ATL.
  
  I consistently violate presentation zen and I try to make my slides usable after the talk but I decided to do a few blog posts covering the topics I put in the talk anyway.
  
  Post [3] JBoss/Tomcat server-status
  
  There have been some posts/exploits/modules on hitting up unprotected jboss and tomcat servers.
  
  http://www.nruns.com/_downloads/Whitepaper-Hacking-jBoss-using-a-Browser.pdf
  http://carnal0wnage.attackresearch.com/2009/11/hacking-unprotected-jboss-jmx-console.html
  http://www.notsosecure.com/folder2/2009/10/27/hacking-jboss-with-jmx-console/
  http://goohackle.com/jboss-security-vulnerability-jmx-management-console/
  
  http://www.metasploit.com/modules/exploit/multi/http/jboss_maindeployer
  http://www.metasploit.com/modules/exploit/multi/http/tomcat_mgr_deploy
  
  Sometimes even though the deployer functionality is password protected the sever-status may not be.
  
  /web-console/status?full=true
  
  
  
  /manager/status/all
  
  
  
  LOW?
  
  This can be useful to find:
  
  
  

  • Lists of applications
  • Recent URL's accessed
  • sometimes with sessionids 
  • Find hidden services/apps
  • Enabled servlets
  • owned stuff :-)

  Finding 0wned stuff is always fun let's see
  Looking at the list of applications list one that doesnt look normal (zecmd)
  Following that down leads us to zecmd.jsp that is a jsp shell
  
  If you are interested in zecmd.jsp and jboss worm it comes from -->  this is a good write up as well as this OWASP preso https://www.owasp.org/images/a/a9/OWASP3011_Luca.pdf
  thoughts?
  -CG
  
  

  Tags:  talk nbsp tomcat atlanta owasp security-vulnerability bsides Pentesting  

• April 17, 2012
• 0:00

  Vuln: Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses

  Tags:  tomcat http apache apache-tomcat digest-authentication security-weaknesses  

• 0:00

  Vuln: Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

  Tags:  memoryuserdatabase tomcat apache information-disclosure-vulnerability apache-tomcat  

• April 12, 2012
• 0:00

  Vuln: Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

  Tags:  memoryuserdatabase tomcat apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Parameter Handling Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Parameter Handling Denial of Service Vulnerability

  Tags:  parameter tomcat apache apache-tomcat service-vulnerability denial-of-service  

• 0:00

  Vuln: Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses

  Tags:  tomcat http apache apache-tomcat digest-authentication security-weaknesses  

• April 11, 2012
• 20:14

  Red Hat Security Advisory 2012-0475-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2012-0475-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue. The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.

  Tags:  apache http tomcat max javaserver-pages-technologies apache-tomcat red-hat-security  

• 20:14

  Red Hat Security Advisory 2012-0475-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-0475-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue. The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.

  Tags:  apache http tomcat max javaserver-pages-technologies apache-tomcat red-hat-security  

• 20:14

  Red Hat Security Advisory 2012-0475-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0475-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue. The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.

  Tags:  apache http tomcat max javaserver-pages-technologies apache-tomcat red-hat-security  

• 20:11

  Red Hat Security Advisory 2012-0474-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2012-0474-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue. The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.

  Tags:  apache http tomcat max javaserver-pages-technologies apache-tomcat red-hat-security  

• 20:11

  Red Hat Security Advisory 2012-0474-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2012-0474-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that the Java hashCode() method implementation was susceptible to predictable hash collisions. A remote attacker could use this flaw to cause Tomcat to use an excessive amount of CPU time by sending an HTTP request with a large number of parameters whose names map to the same hash value. This update introduces a limit on the number of parameters processed per request to mitigate this issue. The default limit is 512 for parameters and 128 for headers. These defaults can be changed by setting the org.apache.tomcat.util.http.Parameters.MAX_COUNT and org.apache.tomcat.util.http.MimeHeaders.MAX_COUNT system properties.

  Tags:  apache http tomcat max javaserver-pages-technologies apache-tomcat red-hat-security  

• 0:00

  Vuln: Apache Tomcat Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Hash Collision Denial Of Service Vulnerability

  Tags:  tomcat hash apache hash-collision apache-tomcat service-vulnerability  

• 0:00

  Vuln: Apache Tomcat Parameter Handling Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Parameter Handling Denial of Service Vulnerability

  Tags:  parameter tomcat apache apache-tomcat service-vulnerability denial-of-service  

• March 28, 2012
• 0:00

  Vuln: Apache Tomcat Parameter Handling Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Parameter Handling Denial of Service Vulnerability

  Tags:  parameter tomcat apache apache-tomcat service-vulnerability denial-of-service  

• 0:00

  Vuln: Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability

  Tags:  tomcat ssl apache information-disclosure-vulnerability apache-tomcat cipher  

• March 18, 2012
• 17:41

  Apache Tomcat WAR Upload / Account Scanner

   » ‎ Packet Storm Security Exploits
  This exploit attempts various Tomcat login access combinations and attempts to launch a reverse shell once successful.

  Tags:  war tomcat apache apache-tomcat exploit combinations  

• 17:41

  Apache Tomcat WAR Upload / Account Scanner

   » ‎ Packet Storm Security Recent Files
  This exploit attempts various Tomcat login access combinations and attempts to launch a reverse shell once successful.

  Tags:  war tomcat apache apache-tomcat exploit combinations  

• 17:41

  Apache Tomcat WAR Upload / Account Scanner

   » ‎ Packet Storm Security Misc. Files
  This exploit attempts various Tomcat login access combinations and attempts to launch a reverse shell once successful.

  Tags:  war tomcat apache apache-tomcat exploit combinations  

• March 16, 2012
• 0:00

  Vuln: Apache Tomcat Parameter Handling Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Parameter Handling Denial of Service Vulnerability

  Tags:  parameter tomcat apache apache-tomcat service-vulnerability denial-of-service  

• 0:00

  Vuln: Apache Tomcat AJP Protocol Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat AJP Protocol Security Bypass Vulnerability

  Tags:  tomcat ajp apache apache-tomcat protocol-security  

• 0:00

  Vuln: Apache Tomcat Request Object Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Request Object Security Bypass Vulnerability

  Tags:  request tomcat apache apache-tomcat object-security request-object  

• March 07, 2012
• 0:00

  Vuln: Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SSL Anonymous Cipher Configuration Information Disclosure Vulnerability

  Tags:  tomcat ssl apache information-disclosure-vulnerability apache-tomcat cipher  

• March 01, 2012
• 0:00

  Vuln: Apache Tomcat Parameter Handling Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Parameter Handling Denial of Service Vulnerability

  Tags:  parameter tomcat apache apache-tomcat service-vulnerability denial-of-service  

• February 13, 2012
• 0:00

  Vuln: Apache Tomcat Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Hash Collision Denial Of Service Vulnerability

  Tags:  tomcat hash apache hash-collision apache-tomcat service-vulnerability  

• 0:00

  Vuln: Apache Tomcat Parameter Handling Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Parameter Handling Denial of Service Vulnerability

  Tags:  parameter tomcat apache apache-tomcat service-vulnerability denial-of-service  

• 0:00

  Vuln: Apache Tomcat Request Object Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Request Object Security Bypass Vulnerability

  Tags:  request tomcat apache apache-tomcat object-security request-object  

• February 06, 2012
• 0:00

  Vuln: Apache Tomcat Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Hash Collision Denial Of Service Vulnerability

  Tags:  tomcat hash apache hash-collision apache-tomcat service-vulnerability  

• February 03, 2012
• 8:02

  Bugtraq: [SECURITY] [DSA 2401-1] tomcat6 security update

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2401-1] tomcat6 security update

  Tags:  security dsa tomcat  

• February 02, 2012
• 0:00

  Vuln: Apache Tomcat Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Hash Collision Denial Of Service Vulnerability

  Tags:  tomcat hash apache hash-collision apache-tomcat service-vulnerability  

• 0:00

  Vuln: Apache Tomcat Request Object Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Request Object Security Bypass Vulnerability

  Tags:  request tomcat apache apache-tomcat object-security request-object  

• 0:00

  Vuln: Apache Tomcat Parameter Handling Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Parameter Handling Denial of Service Vulnerability

  Tags:  parameter tomcat apache apache-tomcat service-vulnerability denial-of-service  

• January 27, 2012
• 0:00

  Vuln: Apache Tomcat AJP Protocol Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat AJP Protocol Security Bypass Vulnerability

  Tags:  tomcat ajp apache apache-tomcat protocol-security  

• 0:00

  Vuln: Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

  Tags:  tomcat sendfile apache information-disclosure-vulnerability apache-tomcat  

• January 20, 2012
• 0:00

  Vuln: Apache Tomcat Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Hash Collision Denial Of Service Vulnerability

  Tags:  tomcat hash apache hash-collision apache-tomcat service-vulnerability  

• January 19, 2012
• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• 0:00

  Vuln: Apache Tomcat WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat WAR File Directory Traversal Vulnerability

  Tags:  war tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

  Tags:  authentication tomcat apache information-disclosure-vulnerability authentication-header apache-tomcat  

• January 18, 2012
• 0:00

  Vuln: Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTTP DIGEST Authentication Multiple Security Weaknesses

  Tags:  tomcat http apache apache-tomcat digest-authentication security-weaknesses  

• January 17, 2012
• 16:29

  Apache Tomcat Large Number Denial Of Service

   » ‎ Packet Storm Security Advisories
  Apache Tomcat versions 7.0.0 through 7.0.22, 6.0.0 through 6.0.33 and 5.5.0 through 5.5.34 suffer from a denial of service vulnerability. Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause large amounts of CPU to be used which in turn could create a denial of service. The issue was addressed by modifying the Tomcat parameter handling code to efficiently process large numbers of parameters and parameter values.

  Tags:  tomcat denial apache hash-collision apache-tomcat vulnerability-analysis  

• 16:29

  Apache Tomcat Large Number Denial Of Service

   » ‎ Packet Storm Security Recent Files
  Apache Tomcat versions 7.0.0 through 7.0.22, 6.0.0 through 6.0.33 and 5.5.0 through 5.5.34 suffer from a denial of service vulnerability. Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause large amounts of CPU to be used which in turn could create a denial of service. The issue was addressed by modifying the Tomcat parameter handling code to efficiently process large numbers of parameters and parameter values.

  Tags:  tomcat denial apache hash-collision apache-tomcat vulnerability-analysis  

• 16:29

  Apache Tomcat Large Number Denial Of Service

   » ‎ Packet Storm Security Misc. Files
  Apache Tomcat versions 7.0.0 through 7.0.22, 6.0.0 through 6.0.33 and 5.5.0 through 5.5.34 suffer from a denial of service vulnerability. Analysis of the recent hash collision vulnerability identified unrelated inefficiencies with Apache Tomcat's handling of large numbers of parameters and parameter values. These inefficiencies could allow an attacker, via a specially crafted request, to cause large amounts of CPU to be used which in turn could create a denial of service. The issue was addressed by modifying the Tomcat parameter handling code to efficiently process large numbers of parameters and parameter values.

  Tags:  tomcat denial apache hash-collision apache-tomcat vulnerability-analysis  

• 7:03

  Bugtraq: [SECURITY] CVE-2011-3375 Apache Tomcat Information disclosure

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2011-3375 Apache Tomcat Information disclosure

  Tags:  security tomcat apache apache-tomcat information-disclosure  

• 7:03

  Bugtraq: [SECURITY] CVE-2012-0022 Apache Tomcat Denial of Service

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2012-0022 Apache Tomcat Denial of Service

  Tags:  security tomcat apache apache-tomcat denial-of-service service-security  

• 0:00

  Vuln: Apache Tomcat Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Hash Collision Denial Of Service Vulnerability

  Tags:  tomcat hash apache hash-collision apache-tomcat service-vulnerability  

• January 06, 2012
• 0:00

  Vuln: Apache Tomcat Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Hash Collision Denial Of Service Vulnerability

  Tags:  tomcat hash apache hash-collision apache-tomcat service-vulnerability  

• January 04, 2012
• 0:00

  Vuln: Apache Tomcat AJP Protocol Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat AJP Protocol Security Bypass Vulnerability

  Tags:  tomcat ajp apache apache-tomcat protocol-security  

• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• December 29, 2011
• 0:00

  Vuln: Apache Tomcat Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Hash Collision Denial Of Service Vulnerability

  Tags:  tomcat hash apache hash-collision apache-tomcat service-vulnerability  

• December 23, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• 0:00

  Vuln: Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

  Tags:  tomcat http apache apache-tomcat digest-authentication security-weaknesses  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

  Tags:  memoryuserdatabase tomcat apache information-disclosure-vulnerability apache-tomcat  

• December 21, 2011
• 0:00

  Vuln: Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

  Tags:  tomcat http apache apache-tomcat digest-authentication security-weaknesses  

• December 20, 2011
• 11:39

  Red Hat Security Advisory 2011-1845-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2011-1845-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web application could use this flaw to trick Tomcat into giving it read and write access to an arbitrary directory on the file system. A cross-site scripting flaw was found in the Manager application, used for managing web applications on Apache Tomcat. A malicious web application could use this flaw to conduct an XSS attack, leading to arbitrary web script execution with the privileges of victims who are logged into and viewing Manager application web pages.

  Tags:  tomcat web application javaserver-pages-technologies apache-tomcat red-hat-security  

• 11:39

  Red Hat Security Advisory 2011-1845-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2011-1845-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web application could use this flaw to trick Tomcat into giving it read and write access to an arbitrary directory on the file system. A cross-site scripting flaw was found in the Manager application, used for managing web applications on Apache Tomcat. A malicious web application could use this flaw to conduct an XSS attack, leading to arbitrary web script execution with the privileges of victims who are logged into and viewing Manager application web pages.

  Tags:  tomcat web application javaserver-pages-technologies apache-tomcat red-hat-security  

• 11:39

  Red Hat Security Advisory 2011-1845-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2011-1845-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. It was found that web applications could modify the location of the Tomcat host's work directory. As web applications deployed on Tomcat have read and write access to this directory, a malicious web application could use this flaw to trick Tomcat into giving it read and write access to an arbitrary directory on the file system. A cross-site scripting flaw was found in the Manager application, used for managing web applications on Apache Tomcat. A malicious web application could use this flaw to conduct an XSS attack, leading to arbitrary web script execution with the privileges of victims who are logged into and viewing Manager application web pages.

  Tags:  tomcat web application javaserver-pages-technologies apache-tomcat red-hat-security  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

  Tags:  memoryuserdatabase tomcat apache information-disclosure-vulnerability apache-tomcat  

• December 06, 2011
• 0:00

  Vuln: Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

  Tags:  memoryuserdatabase tomcat apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

  Tags:  tomcat http apache apache-tomcat digest-authentication security-weaknesses  

• 0:00

  Vuln: Apache Tomcat AJP Protocol Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat AJP Protocol Security Bypass Vulnerability

  Tags:  tomcat ajp apache apache-tomcat protocol-security  

• December 05, 2011
• 6:22

  Red Hat Security Advisory 2011-1780-01

   » ‎ Packet Storm Security Advisories
  Red Hat Security Advisory 2011-1780-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. APR as mentioned in the CVE-2011-3190 and CVE-2011-2526 descriptions does not refer to APR provided by the apr packages. It refers to the implementation of APR provided by the Tomcat Native library, which provides support for using APR with Tomcat. This library is not shipped with Red Hat Enterprise Linux 6. This update includes fixes for users who have elected to use APR with Tomcat by taking the Tomcat Native library from a different product. Such a configuration is not supported by Red Hat, however.

  Tags:  tomcat red apr javaserver-pages-technologies apache-tomcat red-hat-security  

• 6:22

  Red Hat Security Advisory 2011-1780-01

   » ‎ Packet Storm Security Recent Files
  Red Hat Security Advisory 2011-1780-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. APR as mentioned in the CVE-2011-3190 and CVE-2011-2526 descriptions does not refer to APR provided by the apr packages. It refers to the implementation of APR provided by the Tomcat Native library, which provides support for using APR with Tomcat. This library is not shipped with Red Hat Enterprise Linux 6. This update includes fixes for users who have elected to use APR with Tomcat by taking the Tomcat Native library from a different product. Such a configuration is not supported by Red Hat, however.

  Tags:  tomcat red apr javaserver-pages-technologies apache-tomcat red-hat-security  

• 6:22

  Red Hat Security Advisory 2011-1780-01

   » ‎ Packet Storm Security Misc. Files
  Red Hat Security Advisory 2011-1780-01 - Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages technologies. APR as mentioned in the CVE-2011-3190 and CVE-2011-2526 descriptions does not refer to APR provided by the apr packages. It refers to the implementation of APR provided by the Tomcat Native library, which provides support for using APR with Tomcat. This library is not shipped with Red Hat Enterprise Linux 6. This update includes fixes for users who have elected to use APR with Tomcat by taking the Tomcat Native library from a different product. Such a configuration is not supported by Red Hat, however.

  Tags:  tomcat red apr javaserver-pages-technologies apache-tomcat red-hat-security  

• 0:00

  Vuln: Apache Tomcat AJP Protocol Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat AJP Protocol Security Bypass Vulnerability

  Tags:  tomcat ajp apache apache-tomcat protocol-security  

• 0:00

  Vuln: Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

  Tags:  tomcat sendfile apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

  Tags:  tomcat http apache apache-tomcat digest-authentication security-weaknesses  

• November 23, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

  Tags:  tomcat sort apache apache-tomcat orderby vulnerabilities  

• November 22, 2011
• 0:00

  Vuln: Apache Tomcat AJP Protocol Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat AJP Protocol Security Bypass Vulnerability

  Tags:  tomcat ajp apache apache-tomcat protocol-security  

• November 09, 2011
• 0:20

  Apache Tomcat 7.0.21 Privilege Escalation

   » ‎ Packet Storm Security Advisories
  Apache Tomcat versions 7.0.0 through 7.0.21 suffer from a privilege escalation vulnerability.

  Tags:  tomcat privilege apache apache-tomcat privilege-escalation-vulnerability escalation  

• 0:20

  Apache Tomcat 7.0.21 Privilege Escalation

   » ‎ Packet Storm Security Recent Files
  Apache Tomcat versions 7.0.0 through 7.0.21 suffer from a privilege escalation vulnerability.

  Tags:  tomcat privilege apache apache-tomcat privilege-escalation-vulnerability escalation  

• 0:20

  Apache Tomcat 7.0.21 Privilege Escalation

   » ‎ Packet Storm Security Misc. Files
  Apache Tomcat versions 7.0.0 through 7.0.21 suffer from a privilege escalation vulnerability.

  Tags:  tomcat privilege apache apache-tomcat privilege-escalation-vulnerability escalation  

• November 08, 2011
• 12:00

  Bugtraq: [SECURITY] CVE-2011-3376 Apache Tomcat - Privilege Escalation via Manager app

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2011-3376 Apache Tomcat - Privilege Escalation via Manager app

  Tags:  security tomcat apache apache-tomcat escalation privilege  

• November 07, 2011
• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• November 01, 2011
• 0:00

  Vuln: Apache Tomcat AJP Protocol Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat AJP Protocol Security Bypass Vulnerability

  Tags:  tomcat ajp apache apache-tomcat protocol-security  

• October 20, 2011
• 0:00

  Vuln: Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

  Tags:  tomcat sendfile apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat AJP Protocol Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat AJP Protocol Security Bypass Vulnerability

  Tags:  tomcat ajp apache apache-tomcat protocol-security  

• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• October 18, 2011
• 13:01

  Bugtraq: [ MDVSA-2011:156 ] tomcat5

   » ‎ SecurityFocus Vulnerabilities
  [ MDVSA-2011:156 ] tomcat5

  Tags:  bugtraq mdvsa tomcat  

• 12:40

  Mandriva Linux Security Advisory 2011-156

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2011-156 - Multiple vulnerabilities has been discovered and corrected in tomcat 5.5.x. The implementation of HTTP DIGEST authentication in tomcat was discovered to have several weaknesses. Apache Tomcat, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. Apache Tomcat, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service by leveraging an untrusted web application. Certain AJP protocol connector implementations in Apache Tomcat allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request. The updated packages have been patched to correct these issues.

  Tags:  http tomcat apache mandriva-linux digest-authentication apache-tomcat  

• 12:40

  Mandriva Linux Security Advisory 2011-156

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2011-156 - Multiple vulnerabilities has been discovered and corrected in tomcat 5.5.x. The implementation of HTTP DIGEST authentication in tomcat was discovered to have several weaknesses. Apache Tomcat, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. Apache Tomcat, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service by leveraging an untrusted web application. Certain AJP protocol connector implementations in Apache Tomcat allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request. The updated packages have been patched to correct these issues.

  Tags:  http tomcat apache mandriva-linux digest-authentication apache-tomcat  

• 12:40

  Mandriva Linux Security Advisory 2011-156

   » ‎ Packet Storm Security Misc. Files
  Mandriva Linux Security Advisory 2011-156 - Multiple vulnerabilities has been discovered and corrected in tomcat 5.5.x. The implementation of HTTP DIGEST authentication in tomcat was discovered to have several weaknesses. Apache Tomcat, when the MemoryUserDatabase is used, creates log entries containing passwords upon encountering errors in JMX user creation, which allows local users to obtain sensitive information by reading a log file. Apache Tomcat, when sendfile is enabled for the HTTP APR or HTTP NIO connector, does not validate certain request attributes, which allows local users to bypass intended file access restrictions or cause a denial of service by leveraging an untrusted web application. Certain AJP protocol connector implementations in Apache Tomcat allow remote attackers to spoof AJP requests, bypass authentication, and obtain sensitive information by causing the connector to interpret a request body as a new request. The updated packages have been patched to correct these issues.

  Tags:  http tomcat apache mandriva-linux digest-authentication apache-tomcat  

• 0:00

  Vuln: Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

  Tags:  tomcat sendfile apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

  Tags:  tomcat http apache apache-tomcat digest-authentication security-weaknesses  

• 0:00

  Vuln: Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

  Tags:  memoryuserdatabase tomcat apache information-disclosure-vulnerability apache-tomcat  

• October 13, 2011
• 0:00

  Vuln: Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

  Tags:  tomcat sort apache apache-tomcat orderby vulnerabilities  

• September 26, 2011
• 17:33

  Apache Tomcat HTTP Digest Authentication

   » ‎ Packet Storm Security Advisories
  Apache Tomcat suffers from multiple weaknesses in HTTP Digest authentication. It suffers from replay attacks, lack of value checking, and more. Tomcat versions 7.0.0 to 7.0.11, 6.0.0 to 6.0.32, and 5.5.0 to 5.5.33 are affected.

  Tags:  tomcat http apache apache-tomcat digest-authentication replay  

• 17:33

  Apache Tomcat HTTP Digest Authentication

   » ‎ Packet Storm Security Recent Files
  Apache Tomcat suffers from multiple weaknesses in HTTP Digest authentication. It suffers from replay attacks, lack of value checking, and more. Tomcat versions 7.0.0 to 7.0.11, 6.0.0 to 6.0.32, and 5.5.0 to 5.5.33 are affected.

  Tags:  tomcat http apache apache-tomcat digest-authentication replay  

• 17:33

  Apache Tomcat HTTP Digest Authentication

   » ‎ Packet Storm Security Misc. Files
  Apache Tomcat suffers from multiple weaknesses in HTTP Digest authentication. It suffers from replay attacks, lack of value checking, and more. Tomcat versions 7.0.0 to 7.0.11, 6.0.0 to 6.0.32, and 5.5.0 to 5.5.33 are affected.

  Tags:  tomcat http apache apache-tomcat digest-authentication replay  

• 11:02

  Bugtraq: [SECURITY] CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST authentication

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2011-1184 Apache Tomcat - Multiple weaknesses in HTTP DIGEST authentication

  Tags:  security tomcat apache digest-authentication  

• 0:00

  Vuln: Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTTP DIGEST Authentication CVE-2011-1184 Multiple Security Weaknesses

  Tags:  tomcat http apache apache-tomcat digest-authentication security-weaknesses  

• September 07, 2011
• 0:00

  Vuln: Apache Tomcat AJP Protocol Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat AJP Protocol Security Bypass Vulnerability

  Tags:  tomcat ajp apache apache-tomcat protocol-security  

• September 05, 2011
• 0:00

  Vuln: Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'MemoryUserDatabase' Information Disclosure Vulnerability

  Tags:  memoryuserdatabase tomcat apache information-disclosure-vulnerability apache-tomcat  

• August 29, 2011
• 18:57

  Apache Tomcat Authentication Bypass / Information Disclosure

   » ‎ Packet Storm Security Advisories
  Apache Tomcat versions 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, and 5.5.0 through 5.5.33 suffer from authentication bypass and information disclosure vulnerabilities. suffers from a bypass vulnerability.

  Tags:  tomcat bypass apache apache-tomcat information-disclosure vulnerabilities  

• 18:57

  Apache Tomcat Authentication Bypass / Information Disclosure

   » ‎ Packet Storm Security Recent Files
  Apache Tomcat versions 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, and 5.5.0 through 5.5.33 suffer from authentication bypass and information disclosure vulnerabilities. suffers from a bypass vulnerability.

  Tags:  tomcat bypass apache apache-tomcat information-disclosure vulnerabilities  

• 18:57

  Apache Tomcat Authentication Bypass / Information Disclosure

   » ‎ Packet Storm Security Misc. Files
  Apache Tomcat versions 7.0.0 through 7.0.20, 6.0.0 through 6.0.33, and 5.5.0 through 5.5.33 suffer from authentication bypass and information disclosure vulnerabilities. suffers from a bypass vulnerability.

  Tags:  tomcat bypass apache apache-tomcat information-disclosure vulnerabilities  

• August 15, 2011
• 0:00

  Vuln: Apache Tomcat CVE-2011-2481 Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat CVE-2011-2481 Information Disclosure Vulnerability

  Tags:  tomcat apache information information-disclosure-vulnerability apache-tomcat cve  

• August 13, 2011
• 13:25

  Apache Tomcat 7.0.0 Through 7.0.16 Information Disclosure

   » ‎ Packet Storm Security Advisories
  The re-factoring of XML validation for Tomcat 7.0.x re-introduced the vulnerability previously reported as CVE-2009-0783. This was initially reported as a memory leak. If a web application is the first web application loaded, this bug allows that web application to potentially view and/or alter the web.xml, context.xml and tld files of other web applications deployed on the Tomcat instance.

  Tags:  tomcat web application apache-tomcat information-disclosure memory-leak  

• 13:25

  Apache Tomcat 7.0.0 Through 7.0.16 Information Disclosure

   » ‎ Packet Storm Security Recent Files
  The re-factoring of XML validation for Tomcat 7.0.x re-introduced the vulnerability previously reported as CVE-2009-0783. This was initially reported as a memory leak. If a web application is the first web application loaded, this bug allows that web application to potentially view and/or alter the web.xml, context.xml and tld files of other web applications deployed on the Tomcat instance.

  Tags:  tomcat web application apache-tomcat information-disclosure memory-leak  

• 13:25

  Apache Tomcat 7.0.0 Through 7.0.16 Information Disclosure

   » ‎ Packet Storm Security Misc. Files
  The re-factoring of XML validation for Tomcat 7.0.x re-introduced the vulnerability previously reported as CVE-2009-0783. This was initially reported as a memory leak. If a web application is the first web application loaded, this bug allows that web application to potentially view and/or alter the web.xml, context.xml and tld files of other web applications deployed on the Tomcat instance.

  Tags:  tomcat web application apache-tomcat information-disclosure memory-leak  

• August 12, 2011
• 8:54

  Commons Daemokn Fails To Drop Capabilities

   » ‎ Packet Storm Security Recent Files
  Due to a bug in the capabilities code, jsvc (the service wrapper for Linux that is part of the Commons Daemon project) does not drop capabilities allowing the application to access files and directories owned by superuser. Tomcat versions 7.0.0 to 7.0.19, 6.0.30 to 6.0.32, and 5.5.32 to 5.5.33 are affected.

  Tags:  commons drop daemokn tomcat daemon capabilities  

• 8:54

  Commons Daemokn Fails To Drop Capabilities

   » ‎ Packet Storm Security Misc. Files
  Due to a bug in the capabilities code, jsvc (the service wrapper for Linux that is part of the Commons Daemon project) does not drop capabilities allowing the application to access files and directories owned by superuser. Tomcat versions 7.0.0 to 7.0.19, 6.0.30 to 6.0.32, and 5.5.32 to 5.5.33 are affected.

  Tags:  commons drop daemokn tomcat daemon capabilities  

• August 07, 2011
• 20:34

  Apache Tomcat Information Disclosure Vulnerability

   » ‎ SecuriTeam
  An Information Disclosure vulnerability was identified in Apache Tomcat.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  tomcat apache information information-disclosure-vulnerability apache-tomcat safer-use  

• July 29, 2011
• 0:00

  Vuln: Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sendfile' Request Attributes Information Disclosure Vulnerability

  Tags:  tomcat sendfile apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• July 22, 2011
• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• July 15, 2011
• 20:37

  Apache Tomcat Information Disclosure And Availability

   » ‎ Packet Storm Security Advisories
  Tomcat versions 7.0.0 through 7.0.18, 6.0.0 through 6.0.32, and 5.5.0 through 5.5.33 suffer from an information disclosure vulnerability. Tomcat provides support for sendfile with the HTTP NIO and HTTP APR connectors. sendfile is used automatically for content served via the DefaultServlet and deployed web applications may use it directly via setting request attributes. These request attributes were not validated.

  Tags:  disclosure tomcat information information-disclosure-vulnerability apache-tomcat sendfile  

• 20:37

  Apache Tomcat Information Disclosure And Availability

   » ‎ Packet Storm Security Recent Files
  Tomcat versions 7.0.0 through 7.0.18, 6.0.0 through 6.0.32, and 5.5.0 through 5.5.33 suffer from an information disclosure vulnerability. Tomcat provides support for sendfile with the HTTP NIO and HTTP APR connectors. sendfile is used automatically for content served via the DefaultServlet and deployed web applications may use it directly via setting request attributes. These request attributes were not validated.

  Tags:  disclosure tomcat information information-disclosure-vulnerability apache-tomcat sendfile  

• 20:37

  Apache Tomcat Information Disclosure And Availability

   » ‎ Packet Storm Security Misc. Files
  Tomcat versions 7.0.0 through 7.0.18, 6.0.0 through 6.0.32, and 5.5.0 through 5.5.33 suffer from an information disclosure vulnerability. Tomcat provides support for sendfile with the HTTP NIO and HTTP APR connectors. sendfile is used automatically for content served via the DefaultServlet and deployed web applications may use it directly via setting request attributes. These request attributes were not validated.

  Tags:  disclosure tomcat information information-disclosure-vulnerability apache-tomcat sendfile  

• June 28, 2011
• 12:19

  Apache Tomcat Information Disclosure

   » ‎ Packet Storm Security Advisories
  Tomcat versions 7.0.0 through 7.0.16, 6.0.0 through 6.0.32, and 5.5.0 through 5.5.33 suffer from an information disclosure vulnerability. When using the MemoryUserDatabase (based on tomcat-users.xml) and creating users via JMX, an exception during the user creation process may trigger an error message in the JMX client that includes the user's password. This error message is also written to the Tomcat logs. User passwords are visible to administrators with JMX access and/or administrators with read access to the tomcat-users.xml file. Users that do not have these permissions but are able to read log files may be able to discover a user's password.

  Tags:  user jmx tomcat information-disclosure-vulnerability apache-tomcat error-message  

• 12:19

  Apache Tomcat Information Disclosure

   » ‎ Packet Storm Security Recent Files
  Tomcat versions 7.0.0 through 7.0.16, 6.0.0 through 6.0.32, and 5.5.0 through 5.5.33 suffer from an information disclosure vulnerability. When using the MemoryUserDatabase (based on tomcat-users.xml) and creating users via JMX, an exception during the user creation process may trigger an error message in the JMX client that includes the user's password. This error message is also written to the Tomcat logs. User passwords are visible to administrators with JMX access and/or administrators with read access to the tomcat-users.xml file. Users that do not have these permissions but are able to read log files may be able to discover a user's password.

  Tags:  user jmx tomcat information-disclosure-vulnerability apache-tomcat error-message  

• 12:19

  Apache Tomcat Information Disclosure

   » ‎ Packet Storm Security Misc. Files
  Tomcat versions 7.0.0 through 7.0.16, 6.0.0 through 6.0.32, and 5.5.0 through 5.5.33 suffer from an information disclosure vulnerability. When using the MemoryUserDatabase (based on tomcat-users.xml) and creating users via JMX, an exception during the user creation process may trigger an error message in the JMX client that includes the user's password. This error message is also written to the Tomcat logs. User passwords are visible to administrators with JMX access and/or administrators with read access to the tomcat-users.xml file. Users that do not have these permissions but are able to read log files may be able to discover a user's password.

  Tags:  user jmx tomcat information-disclosure-vulnerability apache-tomcat error-message  

• June 23, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• June 22, 2011
• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• May 17, 2011
• 18:29

  Apache Tomcat Security Constraint Bypass

   » ‎ Packet Storm Security Advisories
  An error in the fixes for CVE-2011-1088 and CVE-2011-1183 for Apache Tomcat versions 7.0.12 and 7.0.13 meant that security constraints configured via annotations were ignored on the first request to a Servlet. Subsequent requests were secured correctly.

  Tags:  tomcat security apache apache-tomcat security-constraints constraint  

• 18:29

  Apache Tomcat Security Constraint Bypass

   » ‎ Packet Storm Security Recent Files
  An error in the fixes for CVE-2011-1088 and CVE-2011-1183 for Apache Tomcat versions 7.0.12 and 7.0.13 meant that security constraints configured via annotations were ignored on the first request to a Servlet. Subsequent requests were secured correctly.

  Tags:  tomcat security apache apache-tomcat security-constraints constraint  

• 18:29

  Apache Tomcat Security Constraint Bypass

   » ‎ Packet Storm Security Misc. Files
  An error in the fixes for CVE-2011-1088 and CVE-2011-1183 for Apache Tomcat versions 7.0.12 and 7.0.13 meant that security constraints configured via annotations were ignored on the first request to a Servlet. Subsequent requests were secured correctly.

  Tags:  tomcat security apache apache-tomcat security-constraints constraint  

• 9:00

  Bugtraq: [SECURITY] CVE-2011-1582 Apache Tomcat security constraint bypass

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2011-1582 Apache Tomcat security constraint bypass

  Tags:  security tomcat apache apache-tomcat constraint  

• April 26, 2011
• 0:00

  Vuln: Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

  Tags:  tomcat sort apache apache-tomcat orderby vulnerabilities  

• April 12, 2011
• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• 0:00

  Vuln: Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability

  Tags:  tomcat requestdispatcher apache information-disclosure-vulnerability apache-tomcat  

• April 06, 2011
• 13:00

  Apache Tomcat 7.0.11 Information Disclosure

   » ‎ Packet Storm Security Advisories
  Changes introduced into Apache Tomcat version 7.0.11 to the HTTP BIO connector to support Servlet 3.0 asynchronous requests did not fully account for HTTP pipelining. As a result, when using HTTP pipelining a range of unexpected behaviours occurred including the mixing up of responses between requests. While the mix-up in responses was only observed between requests from the same user, a mix-up of responses for requests from different users may also be possible.

  Tags:  tomcat http apache apache-tomcat information-disclosure pipelining  

• 13:00

  Apache Tomcat 7.0.11 Information Disclosure

   » ‎ Packet Storm Security Recent Files
  Changes introduced into Apache Tomcat version 7.0.11 to the HTTP BIO connector to support Servlet 3.0 asynchronous requests did not fully account for HTTP pipelining. As a result, when using HTTP pipelining a range of unexpected behaviours occurred including the mixing up of responses between requests. While the mix-up in responses was only observed between requests from the same user, a mix-up of responses for requests from different users may also be possible.

  Tags:  tomcat http apache apache-tomcat information-disclosure pipelining  

• 13:00

  Apache Tomcat 7.0.11 Information Disclosure

   » ‎ Packet Storm Security Misc. Files
  Changes introduced into Apache Tomcat version 7.0.11 to the HTTP BIO connector to support Servlet 3.0 asynchronous requests did not fully account for HTTP pipelining. As a result, when using HTTP pipelining a range of unexpected behaviours occurred including the mixing up of responses between requests. While the mix-up in responses was only observed between requests from the same user, a mix-up of responses for requests from different users may also be possible.

  Tags:  tomcat http apache apache-tomcat information-disclosure pipelining  

• 13:00

  Bugtraq: [SECURITY] CVE-2011-1475 Apache Tomcat information disclosure

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2011-1475 Apache Tomcat information disclosure

  Tags:  security tomcat apache apache-tomcat information-disclosure  

• 12:58

  Apache Tomcat 7.0.11 Security Constraint Bypass

   » ‎ Packet Storm Security Advisories
  A regression in the Apache Tomcat version 7.0.11 fix for CVE-2011-1088 meant that security constraints were ignored when no login configuration was present in the web.xml and the web application was marked as meta-data complete.

  Tags:  tomcat security apache apache-tomcat security-constraints meta-data  

• 12:58

  Apache Tomcat 7.0.11 Security Constraint Bypass

   » ‎ Packet Storm Security Recent Files
  A regression in the Apache Tomcat version 7.0.11 fix for CVE-2011-1088 meant that security constraints were ignored when no login configuration was present in the web.xml and the web application was marked as meta-data complete.

  Tags:  tomcat security apache apache-tomcat security-constraints meta-data  

• 12:58

  Apache Tomcat 7.0.11 Security Constraint Bypass

   » ‎ Packet Storm Security Misc. Files
  A regression in the Apache Tomcat version 7.0.11 fix for CVE-2011-1088 meant that security constraints were ignored when no login configuration was present in the web.xml and the web application was marked as meta-data complete.

  Tags:  tomcat security apache apache-tomcat security-constraints meta-data  

• 12:00

  Bugtraq: [SECURITY] CVE-2011-1183 Apache Tomcat security constraint bypass

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2011-1183 Apache Tomcat security constraint bypass

  Tags:  security tomcat apache apache-tomcat constraint  

• April 01, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• March 30, 2011
• 8:00

  Bugtraq: [SECURITY] [DSA 2207-1] tomcat5.5 security update

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2207-1] tomcat5.5 security update

  Tags:  security dsa tomcat  

• 0:00

  Vuln: Apache Tomcat XML Parser Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat XML Parser Information Disclosure Vulnerability

  Tags:  xml tomcat apache information-disclosure-vulnerability xml-parser apache-tomcat  

• 0:00

  Vuln: Apache Tomcat WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat WAR File Directory Traversal Vulnerability

  Tags:  war tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

  Tags:  directory tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

  Tags:  authentication tomcat apache information-disclosure-vulnerability authentication-header apache-tomcat  

• March 29, 2011
• 14:28

  Ubuntu Security Notice USN-1097-1

   » ‎ Packet Storm Security Advisories
  Ubuntu Security Notice 1097-1 - It was discovered that the Tomcat SecurityManager did not properly restrict the working directory. An attacker could use this flaw to read or write files outside of the intended working directory. It was discovered that Tomcat did not properly escape certain parameters in the Manager application which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. It was discovered that Tomcat incorrectly enforced the maxHttpHeaderSize limit in certain configurations. A remote attacker could use this flaw to cause Tomcat to consume all available memory, resulting in a denial of service.

  Tags:  tomcat attacker ubuntu available-memory denial-of-service server-request  

• 14:28

  Ubuntu Security Notice USN-1097-1

   » ‎ Packet Storm Security Recent Files
  Ubuntu Security Notice 1097-1 - It was discovered that the Tomcat SecurityManager did not properly restrict the working directory. An attacker could use this flaw to read or write files outside of the intended working directory. It was discovered that Tomcat did not properly escape certain parameters in the Manager application which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. It was discovered that Tomcat incorrectly enforced the maxHttpHeaderSize limit in certain configurations. A remote attacker could use this flaw to cause Tomcat to consume all available memory, resulting in a denial of service.

  Tags:  tomcat attacker ubuntu available-memory denial-of-service server-request  

• 14:28

  Ubuntu Security Notice USN-1097-1

   » ‎ Packet Storm Security Misc. Files
  Ubuntu Security Notice 1097-1 - It was discovered that the Tomcat SecurityManager did not properly restrict the working directory. An attacker could use this flaw to read or write files outside of the intended working directory. It was discovered that Tomcat did not properly escape certain parameters in the Manager application which could result in browsers becoming vulnerable to cross-site scripting attacks when processing the output. With cross-site scripting vulnerabilities, if a user were tricked into viewing server output during a crafted server request, a remote attacker could exploit this to modify the contents, or steal confidential data (such as passwords), within the same domain. It was discovered that Tomcat incorrectly enforced the maxHttpHeaderSize limit in certain configurations. A remote attacker could use this flaw to cause Tomcat to consume all available memory, resulting in a denial of service.

  Tags:  tomcat attacker ubuntu available-memory denial-of-service server-request  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• March 15, 2011
• 19:21

  Apache Tomcat Security Constraint Bypass

   » ‎ Packet Storm Security Advisories
  Apache Tomcat suffers from a security constraint bypass vulnerability. When a web application was started, @ServletSecurity annotations were ignored. This meant that some areas of the application may not have been protected as expected. Versions 7.0.0 through 7.0.10 are affected.

  Tags:  tomcat security apache apache-tomcat constraint web-application  

• 19:21

  Apache Tomcat Security Constraint Bypass

   » ‎ Packet Storm Security Recent Files
  Apache Tomcat suffers from a security constraint bypass vulnerability. When a web application was started, @ServletSecurity annotations were ignored. This meant that some areas of the application may not have been protected as expected. Versions 7.0.0 through 7.0.10 are affected.

  Tags:  tomcat security apache apache-tomcat constraint web-application  

• 19:21

  Apache Tomcat Security Constraint Bypass

   » ‎ Packet Storm Security Misc. Files
  Apache Tomcat suffers from a security constraint bypass vulnerability. When a web application was started, @ServletSecurity annotations were ignored. This meant that some areas of the application may not have been protected as expected. Versions 7.0.0 through 7.0.10 are affected.

  Tags:  tomcat security apache apache-tomcat constraint web-application  

• 7:00

  Bugtraq: [SECURITY] CVE-2011-1088 Apache Tomcat security constraint bypass

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2011-1088 Apache Tomcat security constraint bypass

  Tags:  security tomcat apache apache-tomcat constraint  

• March 11, 2011
• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• 0:00

  Vuln: Apache Tomcat '@ServletSecurity' Annotations Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat '@ServletSecurity' Annotations Security Bypass Vulnerability

  Tags:  tomcat apache servletsecurity apache-tomcat annotations vulnerability  

• March 09, 2011
• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• February 21, 2011
• 0:00

  Vuln: Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability

  Tags:  awstats tomcat apache apache-tomcat command-execution arbitrary-command  

• February 18, 2011
• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• February 14, 2011
• 7:00

  Bugtraq: [SECURITY] [DSA 2160-1] tomcat6 security update

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] [DSA 2160-1] tomcat6 security update

  Tags:  security dsa tomcat  

• 0:00

  Vuln: Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat HTML Manager Interface HTML Injection Vulnerability

  Tags:  tomcat html apache apache-tomcat manager-interface vulnerability  

• 0:00

  Vuln: Apache Tomcat SecurityManager Security Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat SecurityManager Security Bypass Vulnerability

  Tags:  tomcat securitymanager apache apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• February 11, 2011
• 0:00

  Vuln: Apache Tomcat Windows Installer Insecure Password Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Windows Installer Insecure Password Vulnerability

  Tags:  tomcat apache windows tomcat-windows apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• February 07, 2011
• 0:00

  Vuln: Apache Tomcat NIO Connector Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat NIO Connector Denial of Service Vulnerability

  Tags:  tomcat nio apache apache-tomcat service-vulnerability denial-of-service  

• February 05, 2011
• 10:03

  Apache Tomcat Manager Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  Apache Tomcat Manager suffers from a cross site scripting vulnerability. Versions 7.0.0 through 7.0.5, 6.0.0 through 6.0.29, and 5.5.0 through 5.5.31 are affected.

  Tags:  tomcat manager apache apache-tomcat cross-site-scripting vulnerability  

• 10:03

  Apache Tomcat Manager Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  Apache Tomcat Manager suffers from a cross site scripting vulnerability. Versions 7.0.0 through 7.0.5, 6.0.0 through 6.0.29, and 5.5.0 through 5.5.31 are affected.

  Tags:  tomcat manager apache apache-tomcat cross-site-scripting vulnerability  

• 10:03

  Apache Tomcat Manager Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  Apache Tomcat Manager suffers from a cross site scripting vulnerability. Versions 7.0.0 through 7.0.5, 6.0.0 through 6.0.29, and 5.5.0 through 5.5.31 are affected.

  Tags:  tomcat manager apache apache-tomcat cross-site-scripting vulnerability  

• 10:02

  Apache Tomcat Denial Of Service

   » ‎ Packet Storm Security Advisories
  Tomcat did not enforce the maxHttpHeaderSize limit while parsing the request line in the NIO HTTP connector. A specially crafted request could trigger an DoS via an OutOfMemoryError. Versions 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 are affected.

  Tags:  tomcat request apache apache-tomcat outofmemoryerror denial-of-service  

• 10:02

  Apache Tomcat Denial Of Service

   » ‎ Packet Storm Security Recent Files
  Tomcat did not enforce the maxHttpHeaderSize limit while parsing the request line in the NIO HTTP connector. A specially crafted request could trigger an DoS via an OutOfMemoryError. Versions 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 are affected.

  Tags:  tomcat request apache apache-tomcat outofmemoryerror denial-of-service  

• 10:02

  Apache Tomcat Denial Of Service

   » ‎ Packet Storm Security Misc. Files
  Tomcat did not enforce the maxHttpHeaderSize limit while parsing the request line in the NIO HTTP connector. A specially crafted request could trigger an DoS via an OutOfMemoryError. Versions 7.0.0 through 7.0.6 and 6.0.0 through 6.0.30 are affected.

  Tags:  tomcat request apache apache-tomcat outofmemoryerror denial-of-service  

• 10:00

  Oracle JVM / Apache Tomcat Denial Of Service

   » ‎ Packet Storm Security Advisories
  An Oracle JVM bug can cause a denial of service condition in Apache Tomcat. Tomcat is affected when accessing a form based security constrained page or any page that calls javax.servlet.ServletRequest.getLocale() or javax.servlet.ServletRequest.getLocales().

  Tags:  jvm tomcat oracle tomcat-tomcat apache-tomcat denial-of-service  

• 10:00

  Oracle JVM / Apache Tomcat Denial Of Service

   » ‎ Packet Storm Security Recent Files
  An Oracle JVM bug can cause a denial of service condition in Apache Tomcat. Tomcat is affected when accessing a form based security constrained page or any page that calls javax.servlet.ServletRequest.getLocale() or javax.servlet.ServletRequest.getLocales().

  Tags:  jvm tomcat oracle tomcat-tomcat apache-tomcat denial-of-service  

• 10:00

  Oracle JVM / Apache Tomcat Denial Of Service

   » ‎ Packet Storm Security Misc. Files
  An Oracle JVM bug can cause a denial of service condition in Apache Tomcat. Tomcat is affected when accessing a form based security constrained page or any page that calls javax.servlet.ServletRequest.getLocale() or javax.servlet.ServletRequest.getLocales().

  Tags:  jvm tomcat oracle tomcat-tomcat apache-tomcat denial-of-service  

• 9:56

  Apache Tomcat Local Bypass

   » ‎ Packet Storm Security Advisories
  Apache Tomcat suffers from a local bypass a of Security Manager file permissions. Versions from 7.0.0, 6.0.0 and 5.5.0 are affected.

  Tags:  tomcat bypass apache apache-tomcat security-manager file-permissions  

• 9:56

  Apache Tomcat Local Bypass

   » ‎ Packet Storm Security Recent Files
  Apache Tomcat suffers from a local bypass a of Security Manager file permissions. Versions from 7.0.0, 6.0.0 and 5.5.0 are affected.

  Tags:  tomcat bypass apache apache-tomcat security-manager file-permissions  

• 9:56

  Apache Tomcat Local Bypass

   » ‎ Packet Storm Security Misc. Files
  Apache Tomcat suffers from a local bypass a of Security Manager file permissions. Versions from 7.0.0, 6.0.0 and 5.5.0 are affected.

  Tags:  tomcat bypass apache apache-tomcat security-manager file-permissions  

• January 24, 2011
• 10:01

  Bugtraq: [USN-1048-1] Tomcat vulnerability

   » ‎ SecurityFocus Vulnerabilities
  [USN-1048-1] Tomcat vulnerability

  Tags:  bugtraq vulnerability tomcat usn  

• January 16, 2011
• 19:19

  HP-UX Apache Running Tomcat Servlet Engine Remote Modification and Denial of Service Vulnerabilities

   » ‎ SecuriTeam
  Multiple vulnerabilities were identified in HP-UX Apache Running Tomcat Servlet Engine.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  hp-ux tomcat apache safer-use denial-of-service  

• 19:17

  HP-UX Apache Running Tomcat Servlet Engine Remote Modification and Denial of Service Vulnerabilities

   » ‎ SecuriTeam
  Multiple vulnerabilities were identified in HP-UX Apache Running Tomcat Servlet Engine.

  -

  Make your website safer. Use external penetration testing service. First report ready in one hour!

  Tags:  hp-ux tomcat apache safer-use denial-of-service  

• January 13, 2011
• 0:00

  Vuln: Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

  Tags:  tomcat sort apache apache-tomcat orderby vulnerabilities  

• January 10, 2011
• 23:01

  Tomcat/JBoss Nmap Script Brute Forcing Tool

   » ‎ Packet Storm Security Recent Files
  Tomcat/JBoss .nse script for nmap that also includes a short dictionary attack for Tomcat's /manager/html basic-auth.

  Tags:  nmap jboss tomcat dictionary-attack brute  

• 23:01

  Tomcat/JBoss Nmap Script Brute Forcing Tool

   » ‎ Packet Storm Security Tools
  Tomcat/JBoss .nse script for nmap that also includes a short dictionary attack for Tomcat's /manager/html basic-auth.

  Tags:  nmap jboss tomcat dictionary-attack brute  

• 23:01

  Tomcat/JBoss Nmap Script Brute Forcing Tool

   » ‎ Packet Storm Security Misc. Files
  Tomcat/JBoss .nse script for nmap that also includes a short dictionary attack for Tomcat's /manager/html basic-auth.

  Tags:  nmap jboss tomcat dictionary-attack brute  

• December 02, 2010
• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• December 01, 2010
• 0:00

  Vuln: Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Awstats Apache Tomcat Configuration File Remote Arbitrary Command Execution Vulnerability

  Tags:  awstats tomcat apache apache-tomcat command-execution arbitrary-command  

• November 24, 2010
• 0:00

  Vuln: Apache Tomcat XML Parser Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat XML Parser Information Disclosure Vulnerability

  Tags:  xml tomcat apache information-disclosure-vulnerability xml-parser apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

  Tags:  authentication tomcat apache information-disclosure-vulnerability authentication-header apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness

  Tags:  tomcat form apache apache-tomcat authentication  

• November 23, 2010
• 9:49

  Apache Tomcat Manager Cross Site Scripting

   » ‎ Packet Storm Security Advisories
  The session list screen (provided by sessionList.jsp) in affected versions of Apache Tomcat Manager uses the orderBy and sort request parameters without applying filtering and therefore is vulnerable to a cross-site scripting attack. Versions 7.0.0 through 7.0.4 and 6.0.12 through 6.0.29 are affected.

  Tags:  tomcat manager apache apache-tomcat request-parameters cross-site-scripting  

• 9:49

  Apache Tomcat Manager Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  The session list screen (provided by sessionList.jsp) in affected versions of Apache Tomcat Manager uses the orderBy and sort request parameters without applying filtering and therefore is vulnerable to a cross-site scripting attack. Versions 7.0.0 through 7.0.4 and 6.0.12 through 6.0.29 are affected.

  Tags:  tomcat manager apache apache-tomcat request-parameters cross-site-scripting  

• 9:49

  Apache Tomcat Manager Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  The session list screen (provided by sessionList.jsp) in affected versions of Apache Tomcat Manager uses the orderBy and sort request parameters without applying filtering and therefore is vulnerable to a cross-site scripting attack. Versions 7.0.0 through 7.0.4 and 6.0.12 through 6.0.29 are affected.

  Tags:  tomcat manager apache apache-tomcat request-parameters cross-site-scripting  

• 0:00

  Vuln: Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'sort' and 'orderBy' Parameters Cross Site Scripting Vulnerabilities

  Tags:  tomcat sort apache apache-tomcat orderby vulnerabilities  

• November 22, 2010
• 12:00

  Bugtraq: [SECURITY] CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2010-4172: Apache Tomcat Manager application XSS vulnerability

  Tags:  security tomcat apache apache-tomcat manager-application vulnerability  

• November 15, 2010
• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• November 01, 2010
• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• October 26, 2010
• 0:00

  Vuln: Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness

  Tags:  tomcat form apache apache-tomcat authentication  

• 0:00

  Vuln: Apache Tomcat XML Parser Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat XML Parser Information Disclosure Vulnerability

  Tags:  xml tomcat apache information-disclosure-vulnerability xml-parser apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability

  Tags:  java tomcat apache tomcat-java apache-tomcat service-vulnerability  

• 0:00

  Vuln: Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability

  Tags:  tomcat requestdispatcher apache information-disclosure-vulnerability apache-tomcat  

• October 15, 2010
• 0:00

  Vuln: Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

  Tags:  authentication tomcat apache information-disclosure-vulnerability authentication-header apache-tomcat  

• 0:00

  Vuln: Apache Tomcat WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat WAR File Directory Traversal Vulnerability

  Tags:  war tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• 0:00

  Vuln: Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

  Tags:  directory tomcat apache directory-traversal-vulnerability apache-tomcat  

• October 13, 2010
• 0:00

  Vuln: Apache Tomcat XML Parser Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat XML Parser Information Disclosure Vulnerability

  Tags:  xml tomcat apache information-disclosure-vulnerability xml-parser apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Java AJP Connector Invalid Header Denial of Service Vulnerability

  Tags:  java tomcat apache tomcat-java apache-tomcat service-vulnerability  

• 0:00

  Vuln: Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability

  Tags:  tomcat requestdispatcher apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Form Authentication Existing/Non-Existing Username Enumeration Weakness

  Tags:  tomcat form apache apache-tomcat authentication  

• September 29, 2010
• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• September 16, 2010
• 0:00

  Vuln: Apache Tomcat Windows Installer Insecure Password Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Windows Installer Insecure Password Vulnerability

  Tags:  tomcat apache windows tomcat-windows apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

  Tags:  directory tomcat apache apache-tomcat vulnerability authentication  

• 0:00

  Vuln: Apache Tomcat WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat WAR File Directory Traversal Vulnerability

  Tags:  war tomcat apache directory-traversal-vulnerability apache-tomcat  

• September 13, 2010
• 0:00

  Vuln: Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

  Tags:  directory tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• 0:00

  Vuln: Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

  Tags:  directory tomcat apache apache-tomcat vulnerability authentication  

• 0:00

  Vuln: Apache Tomcat XML Parser Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat XML Parser Information Disclosure Vulnerability

  Tags:  xml tomcat apache information-disclosure-vulnerability xml-parser apache-tomcat  

• 0:00

  Vuln: Apache Tomcat WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat WAR File Directory Traversal Vulnerability

  Tags:  war tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'RequestDispatcher' Information Disclosure Vulnerability

  Tags:  tomcat requestdispatcher apache information-disclosure-vulnerability apache-tomcat  

• September 12, 2010
• 19:01

  MDVSA-2010-176.txt

   » ‎ Packet Storm Security Recent Files
  Mandriva Linux Security Advisory 2010-176 - Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle characters or sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked this issue exists because of an incomplete fix for CVE-2007-3385. Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via. sequences and the WEB-INF directory in a Request. Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. Other issues have also been addressed.

  Tags:  tomcat directory apache apache-tomcat tomcat-4 denial-of-service  

• 19:00

  MDVSA-2010-176.txt

   » ‎ Packet Storm Security Advisories
  Mandriva Linux Security Advisory 2010-176 - Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle characters or sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked this issue exists because of an incomplete fix for CVE-2007-3385. Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, which allows remote attackers to bypass intended access restrictions and conduct directory traversal attacks via. sequences and the WEB-INF directory in a Request. Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. Other issues have also been addressed.

  Tags:  tomcat directory apache apache-tomcat tomcat-4 denial-of-service  

• September 10, 2010
• 0:00

  Vuln: Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

  Tags:  directory tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat WAR File Directory Traversal Vulnerability

  Tags:  war tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat 'Transfer-Encoding' Information Disclosure and Denial Of Service Vulnerabilities

  Tags:  tomcat encoding apache information-disclosure denial-of-service vulnerabilities  

• August 05, 2010
• 0:00

  Vuln: Apache Tomcat Accept-Language Cross Site Scripting Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Accept-Language Cross Site Scripting Vulnerability

  Tags:  language tomcat apache vulnerability  

• 0:00

  Vuln: Apache Tomcat Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Information Disclosure Vulnerability

  Tags:  tomcat apache information information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability

  Tags:  tomcat cookie apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat WebDav Remote Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat WebDav Remote Information Disclosure Vulnerability

  Tags:  tomcat webdav apache information-disclosure-vulnerability apache-tomcat  

• August 02, 2010
• 0:00

  Vuln: Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Authentication Header Realm Name Information Disclosure Vulnerability

  Tags:  authentication tomcat apache information-disclosure-vulnerability authentication-header apache-tomcat  

• July 28, 2010
• 1:00

  Apache Tomcat < 6.0.18 UTF8 Directory Traversal Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  Apache Tomcat

  Tags:  tomcat utf apache directory-traversal-vulnerability apache-tomcat  

• July 09, 2010
• 14:00

  Bugtraq: [SECURITY] CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2010-2227: Apache Tomcat Remote Denial Of Service and Information Disclosure Vulnerability

  Tags:  security tomcat apache information-disclosure-vulnerability denial-of-service  

• July 06, 2010
• 0:00

  Vuln: Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Cookie Quote Handling Remote Information Disclosure Vulnerability

  Tags:  tomcat cookie apache information-disclosure-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat JSP Example Web Applications Cross Site Scripting Vulnerability

  Tags:  tomcat jsp apache tomcat-jsp jsp-example apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Cross-Site Scripting Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Cross-Site Scripting Vulnerability

  Tags:  tomcat site apache apache-tomcat vulnerability  

• June 17, 2010
• 0:00

  Vuln: Apache Tomcat Windows Installer Insecure Password Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Windows Installer Insecure Password Vulnerability

  Tags:  tomcat apache windows tomcat-windows apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat WAR File Directory Traversal Vulnerability

  Tags:  war tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

  Tags:  directory tomcat apache directory-traversal-vulnerability apache-tomcat  

• May 18, 2010
• 0:00

  Vuln: Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Directory Host Appbase Authentication Bypass Vulnerability

  Tags:  directory tomcat apache apache-tomcat vulnerability authentication  

• 0:00

  Vuln: Apache Tomcat Windows Installer Insecure Password Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Windows Installer Insecure Password Vulnerability

  Tags:  tomcat apache windows tomcat-windows apache-tomcat vulnerability  

• 0:00

  Vuln: Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat Host Working Directory WAR File Directory Traversal Vulnerability

  Tags:  directory tomcat apache directory-traversal-vulnerability apache-tomcat  

• 0:00

  Vuln: Apache Tomcat XML Parser Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Apache Tomcat XML Parser Information Disclosure Vulnerability

  Tags:  xml tomcat apache information-disclosure-vulnerability xml-parser apache-tomcat  

• April 22, 2010
• 8:00

  Bugtraq: [SECURITY] CVE-2010-1157: Apache Tomcat information disclosure vulnerability

   » ‎ SecurityFocus Vulnerabilities
  [SECURITY] CVE-2010-1157: Apache Tomcat information disclosure vulnerability

  Tags:  security tomcat apache information-disclosure-vulnerability apache-tomcat