Tomcat — контейнер сервлетов с открытым исходным кодом

The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.

** DISPUTED ** Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."

Denial of Service in Apache Tomcat

Improper Neutralization of Input During Web Page Generation in Apache Tomcat

Apache Tomcat information disclosure vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Apache Tomcat

Apache Tomcat Denial of Service via Malformed Request Headers

Apache Tomcat Directory Traversal vulnerability

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat