Tomcat — контейнер сервлетов с открытым исходным кодом

Improper Authentication in Apache Tomcat

Improper Authentication in Apache Tomcat

Use of Hard-coded Cryptographic Key in Apache Tomcat

Insertion of Sensitive Information into Log File in Apache Tomcat

Apache Tomcat Allows Remote Attackers to Spoof AJP Requests

Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

Authentication Bypass in Apache Tomcat

The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.

Apache Tomcat Vulnerable to Denial of Service (DoS) via Improper Handling of chunk extensions

Apache Tomcat is vulnerable to HTTP request-smuggling