Tomcat — контейнер сервлетов с открытым исходным кодом

** DISPUTED ** Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."

Denial of Service in Apache Tomcat

Improper Neutralization of Input During Web Page Generation in Apache Tomcat

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat

Improper Authentication in Apache Tomcat

Apache Tomcat Directory Traversal vulnerability

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat on Red Hat Enterprise Linux 5, Desktop Workstation 5, and Linux Desktop 5 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." NOTE: this is due to a missing fix for CVE-2009-0781.

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat