Apache Tomcat OS Command Injection vulnerability

Apache Tomcat Source Code Disclosure

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Apache Tomcat has an Improper Input Validation vulnerability

Denial of Service in Apache Tomcat

Apache Tomcat Default Installation Reveals Sensitive Information

Apache Tomcat Vulnerable to Denial of Service (DoS) via Simultaneous Requests

The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat

Apache Tomcat XSS Vulnerability

Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT

Apache Tomcat Denial of Service vulnerability in the Catalina package

Apache Tomcat Denial of Service due to improper input validation vulnerability for HTTP/2 requests

Apache Tomcat information disclosure vulnerability

** DISPUTED ** Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."

Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authenticate binds using GSSAPI allowed attackers to authenticate without provided the correct password. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.4, from 10.1.0-M1 through 10.1.36, from 9.0.0.M1 through 9.0.100, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Users are recommended to upgrade to version 11.0.5, 10.1.37 or 9.0.101, which fixes the issue.

Cross-Site Request Forgery in Apache Tomcat

Insufficient Verification of Data Authenticity in Apache Tomcat

The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remote attackers to read arbitrary files by directly calling the administrative servlets to add a context for the root directory.

Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat