Tomcat — контейнер сервлетов с открытым исходным кодом

Insertion of Sensitive Information into Log File in Apache Tomcat

Improper Authentication in Apache Tomcat

Apache Tomcat does not properly handle an invalid Transfer-Encoding header

Use of Hard-coded Cryptographic Key in Apache Tomcat

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for files via a request to an application.

Improper Authentication in Apache Tomcat

Improper Input Validation in Apache Tomcat

Apache Tomcat Allows Remote Attackers to Spoof AJP Requests

Improper Limitation of a Pathname to a Restricted Directory in Apache Tomcat

Authentication Bypass in Apache Tomcat