Version prüfen
catalina.sh versionCVEs, die 4.0 betreffen
| CVE | Titel | CVSS | Ausgenutzt | EPSS | Veröffentlicht |
|---|---|---|---|---|---|
| CVE-2025-24813 | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | 10.0 | KEV | 99.9% | 2025-03-11 |
| CVE-2016-8735 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.... | 9.8 | KEV | 90.3% | 2017-04-07 |
| CVE-2026-55276 | Apache Tomcat: Logged effective web.xml is incomplete | 9.1 | — | 2026-06-30 | |
| CVE-2026-59083 | Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass | 9.1 | — | 2026-07-14 | |
| CVE-2002-2272 | Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to... | 7.8 | — | 2007-10-18 | |
| CVE-2020-8022 | User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges | 7.7 | — | 2020-06-29 | |
| CVE-2026-41284 | Apache Tomcat: Unbounded read in WebDAV LOCK and PROPFIND handling | 7.5 | — | 2026-05-13 | |
| CVE-2002-0682 | Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other w... | 7.5 | — | 2004-09-01 | |
| CVE-2002-1394 | Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote at... | 7.5 | — | 2004-09-01 | |
| CVE-2009-3548 | The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versi... | 7.5 | — | 2009-11-13 | |
| CVE-2013-2185 | The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enter... | 7.5 | — | 2014-01-20 | |
| CVE-2026-55957 | Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind | 7.3 | — | 2026-06-30 | |
| CVE-2013-6357 | Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier... | 6.8 | — | 2013-11-14 | |
| CVE-2013-4444 | Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving out... | 6.8 | — | 2014-09-12 | |
| CVE-2026-55955 | Apache Tomcat: EncryptInterceptor not protected against replay attacks | 6.5 | — | 2026-06-30 | |
| CVE-2026-55956 | Apache Tomcat: Security constraints for default servlet ignored method | 6.5 | — | 2026-06-30 | |
| CVE-2026-50229 | Apache Tomcat: XSS in number guess example | 6.1 | — | 2026-06-30 | |
| CVE-2013-4286 | Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connec... | 5.8 | — | 2014-02-26 | |
| CVE-2001-0917 | Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with... | 5.0 | — | 2002-06-25 | |
| CVE-2002-0935 | Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial... | 5.0 | — | 2003-04-02 | |
| CVE-2002-0936 | The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash... | 5.0 | — | 2002-08-31 | |
| CVE-2002-1148 | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allow... | 5.0 | — | 2004-09-01 | |
| CVE-2002-1895 | The servlet engine in Jakarta Apache Tomcat 3.3 and 4.0.4, when using IIS and the ajp1.3 connector, allows rem... | 5.0 | — | 2005-06-28 | |
| CVE-2002-2006 | The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obt... | 5.0 | — | 2005-07-14 | |
| CVE-2002-2008 | Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a... | 5.0 | — | 2005-07-14 | |
| CVE-2002-2009 | Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preced... | 5.0 | — | 2005-07-14 | |
| CVE-2003-0866 | The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to... | 5.0 | — | 2003-10-17 | |
| CVE-2005-4703 | Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a re... | 5.0 | — | 2006-02-02 | |
| CVE-2008-0128 | The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does no... | 5.0 | — | 2008-01-23 | |
| CVE-2014-0075 | Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.... | 5.0 | — | 2014-05-31 | |
| CVE-2005-4838 | Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 a... | 4.3 | — | 2007-04-26 | |
| CVE-2006-7196 | Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.... | 4.3 | — | 2007-05-10 | |
| CVE-2007-1355 | Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in... | 4.3 | — | 2007-05-22 | |
| CVE-2007-2449 | Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Ap... | 4.3 | — | 2007-06-15 | |
| CVE-2007-3383 | Cross-site scripting (XSS) vulnerability in SendMailServlet in the examples web application (examples/jsp/mail... | 4.3 | — | 2007-07-26 | |
| CVE-2008-2938 | Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 throu... | 4.3 | — | 2008-08-13 | |
| CVE-2009-2696 | Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web a... | 4.3 | — | 2010-08-06 | |
| CVE-2013-4322 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding wi... | 4.3 | — | 2014-02-26 | |
| CVE-2013-4590 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat i... | 4.3 | — | 2014-02-26 | |
| CVE-2014-0096 | java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7... | 4.3 | — | 2014-05-31 | |
| CVE-2014-0099 | Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.... | 4.3 | — | 2014-05-31 | |
| CVE-2014-0119 | Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loa... | 4.3 | — | 2014-05-31 | |
| CVE-2007-2450 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications i... | 3.5 | — | 2007-06-15 | |
| CVE-2007-5461 | Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25... | 3.5 | — | 2007-10-16 | |
| CVE-2005-3164 | The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus... | 2.6 | — | 2005-10-06 | |
| CVE-2007-1358 | Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4... | 2.6 | — | 2007-05-10 | |
| CVE-2008-5519 | The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitiv... | 2.6 | — | 2009-04-10 |
Verfolgen Sie diese Versionen auf Ihren eigenen Servern
InfraGuard erfasst die installierten Softwareversionen auf jedem Server und markiert diejenigen mit bekannten Schwachstellen. Self-Hosted – nichts verlässt Ihr Netzwerk.
Daten: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (siehe EPSS unter https://www.first.org/epss), endoflife.date. Softwareliste: awesome-selfhosted (CC BY-SA 3.0).