Tomcat — контейнер сервлетов с открытым исходным кодом

Apache Tomcat may be started without proper security settings

Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this issue is already covered by other CVE identifiers.

Apache Tomcat Reveals Path through Long URL

Apache Tomcat allows webmasters to insert xss into error messages

Apache Tomcat Allows Source Disclosure

Apache Tomcat Directory Traversal

Jakarta Apache Tomcat Reveals Physical Paths

The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

Apache Tomcat Denial of Service vulnerability in the Catalina package