Version prüfen
catalina.sh versionCVEs, die 3.0 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2025-24813 | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | 10.0 | KEV | 99.9% | 2025-03-11 |
| CVE-2016-8735 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.... | 9.8 | KEV | 90.3% | 2017-04-07 |
| CVE-2026-55276 | Apache Tomcat: Logged effective web.xml is incomplete | 9.1 | — | 2026-06-30 | |
| CVE-2026-59083 | Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass | 9.1 | — | 2026-07-14 | |
| CVE-2020-8022 | User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges | 7.7 | — | 2020-06-29 | |
| CVE-2002-0493 | Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.... | 7.5 | — | 2003-04-02 | |
| CVE-2009-3548 | The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versi... | 7.5 | — | 2009-11-13 | |
| CVE-2013-2185 | The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enter... | 7.5 | — | 2014-01-20 | |
| CVE-2026-55957 | Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind | 7.3 | — | 2026-06-30 | |
| CVE-2003-0044 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jaka... | 6.8 | — | 2003-01-29 | |
| CVE-2013-6357 | Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier... | 6.8 | — | 2013-11-14 | |
| CVE-2013-4444 | Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving out... | 6.8 | — | 2014-09-12 | |
| CVE-2026-55955 | Apache Tomcat: EncryptInterceptor not protected against replay attacks | 6.5 | — | 2026-06-30 | |
| CVE-2026-55956 | Apache Tomcat: Security constraints for default servlet ignored method | 6.5 | — | 2026-06-30 | |
| CVE-2000-0760 | The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remot... | 6.4 | — | 2000-09-21 | |
| CVE-2026-50229 | Apache Tomcat: XSS in number guess example | 6.1 | — | 2026-06-30 | |
| CVE-2013-4286 | Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connec... | 5.8 | — | 2014-02-26 | |
| CVE-2000-0672 | The default configuration of Jakarta Tomcat does not restrict access to the /admin context, which allows remot... | 5.0 | — | 2001-01-22 | |
| CVE-2001-0590 | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to a... | 5.0 | — | 2002-03-09 | |
| CVE-2000-1210 | Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read ar... | 5.0 | — | 2003-04-02 | |
| CVE-2002-1148 | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allow... | 5.0 | — | 2004-09-01 | |
| CVE-2002-2006 | The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obt... | 5.0 | — | 2005-07-14 | |
| CVE-2003-0042 | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories... | 5.0 | — | 2003-01-29 | |
| CVE-2003-0043 | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the... | 5.0 | — | 2004-09-01 | |
| CVE-2003-0045 | Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of servic... | 5.0 | — | 2004-09-01 | |
| CVE-2005-0808 | Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafte... | 5.0 | — | 2005-03-20 | |
| CVE-2008-0128 | The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does no... | 5.0 | — | 2008-01-23 | |
| CVE-2014-0075 | Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.... | 5.0 | — | 2014-05-31 | |
| CVE-2005-4838 | Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 a... | 4.3 | — | 2007-04-26 | |
| CVE-2006-7196 | Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.... | 4.3 | — | 2007-05-10 | |
| CVE-2007-2449 | Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Ap... | 4.3 | — | 2007-06-15 | |
| CVE-2009-2696 | Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web a... | 4.3 | — | 2010-08-06 | |
| CVE-2013-4322 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding wi... | 4.3 | — | 2014-02-26 | |
| CVE-2013-4590 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat i... | 4.3 | — | 2014-02-26 | |
| CVE-2014-0096 | java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7... | 4.3 | — | 2014-05-31 | |
| CVE-2014-0099 | Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.... | 4.3 | — | 2014-05-31 | |
| CVE-2014-0119 | Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loa... | 4.3 | — | 2014-05-31 | |
| CVE-2007-1358 | Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4... | 2.6 | — | 2007-05-10 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).