Apache Tomcat may be started without proper security settings

Access controll bypass in Apache Tomcat

Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet resources. NOTE: due to the vagueness of the vendor advisory, it is not clear whether this issue is already covered by other CVE identifiers.

Apache Tomcat may reject request containing invalid Content-Length header

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

Improper Access Control in Apache Tomcat

Apache Tomcat vulnerable to information leak

Apache Tomcat allows remote attackers to bypass intended access restrictions

Apache Tomcat Leaks Information via Error Message

Apache Tomcat Path Traversal Vulnerability

Apache Tomcat Directory Traversal vulnerability

Apache Tomcat Source Code Disclosure

Apache Tomcat Race Condition vulnerability

Improper Neutralization of Input During Web Page Generation in Apache Tomcat

Apache Tomcat Buffer Over-Read

Improper Handling of Exceptional Conditions in Apache Tomcat

Apache Tomcat Incomplete Cleanup vulnerability

Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.

Cross-site scripting in Apache Tomcat

Authentication Bypass in Apache Tomcat