バージョンを確認する
catalina.sh version3.2 に影響するCVE
| CVE | タイトル | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|
| CVE-2025-24813 | Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT | 10.0 | KEV | 99.9% | 2025-03-11 |
| CVE-2016-8735 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.... | 9.8 | KEV | 90.3% | 2017-04-07 |
| CVE-2026-55276 | Apache Tomcat: Logged effective web.xml is incomplete | 9.1 | — | 2026-06-30 | |
| CVE-2026-59083 | Apache Tomcat: Incorrect URL decoding in RewriteValve may allow security control bypass | 9.1 | — | 2026-07-14 | |
| CVE-2020-8022 | User-writeable configuration file /usr/lib/tmpfiles.d/tomcat.conf allows for escalation of priviliges | 7.7 | — | 2020-06-29 | |
| CVE-2001-1563 | Unknown vulnerability in Tomcat 3.2.1 running on HP Secure OS for Linux 1.0 allows attackers to access servlet... | 7.5 | — | 2005-07-14 | |
| CVE-2002-0493 | Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.... | 7.5 | — | 2003-04-02 | |
| CVE-2009-3548 | The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versi... | 7.5 | — | 2009-11-13 | |
| CVE-2013-2185 | The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enter... | 7.5 | — | 2014-01-20 | |
| CVE-2026-55957 | Apache Tomcat: Authentication bypass with JNDIRealm and GSSAPI authenticated bind | 7.3 | — | 2026-06-30 | |
| CVE-2003-0044 | Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jaka... | 6.8 | — | 2003-01-29 | |
| CVE-2013-6357 | Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier... | 6.8 | — | 2013-11-14 | |
| CVE-2013-4444 | Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving out... | 6.8 | — | 2014-09-12 | |
| CVE-2026-55955 | Apache Tomcat: EncryptInterceptor not protected against replay attacks | 6.5 | — | 2026-06-30 | |
| CVE-2026-55956 | Apache Tomcat: Security constraints for default servlet ignored method | 6.5 | — | 2026-06-30 | |
| CVE-2026-50229 | Apache Tomcat: XSS in number guess example | 6.1 | — | 2026-06-30 | |
| CVE-2013-4286 | Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connec... | 5.8 | — | 2014-02-26 | |
| CVE-2001-0829 | A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript i... | 5.1 | — | 2001-11-22 | |
| CVE-2001-0590 | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to a... | 5.0 | — | 2002-03-09 | |
| CVE-2002-1148 | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allow... | 5.0 | — | 2004-09-01 | |
| CVE-2002-2006 | The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obt... | 5.0 | — | 2005-07-14 | |
| CVE-2002-2007 | The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system... | 5.0 | — | 2005-07-14 | |
| CVE-2003-0042 | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories... | 5.0 | — | 2003-01-29 | |
| CVE-2003-0043 | Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the... | 5.0 | — | 2004-09-01 | |
| CVE-2003-0045 | Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of servic... | 5.0 | — | 2004-09-01 | |
| CVE-2005-0808 | Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafte... | 5.0 | — | 2005-03-20 | |
| CVE-2008-0128 | The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does no... | 5.0 | — | 2008-01-23 | |
| CVE-2014-0075 | Integer overflow in the parseChunkHeader function in java/org/apache/coyote/http11/filters/ChunkedInputFilter.... | 5.0 | — | 2014-05-31 | |
| CVE-2005-4838 | Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 a... | 4.3 | — | 2007-04-26 | |
| CVE-2006-7196 | Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.... | 4.3 | — | 2007-05-10 | |
| CVE-2007-2449 | Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Ap... | 4.3 | — | 2007-06-15 | |
| CVE-2009-2696 | Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web a... | 4.3 | — | 2010-08-06 | |
| CVE-2013-4322 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding wi... | 4.3 | — | 2014-02-26 | |
| CVE-2013-4590 | Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat i... | 4.3 | — | 2014-02-26 | |
| CVE-2014-0096 | java/org/apache/catalina/servlets/DefaultServlet.java in the default servlet in Apache Tomcat before 6.0.40, 7... | 4.3 | — | 2014-05-31 | |
| CVE-2014-0099 | Integer overflow in java/org/apache/tomcat/util/buf/Ascii.java in Apache Tomcat before 6.0.40, 7.x before 7.0.... | 4.3 | — | 2014-05-31 | |
| CVE-2014-0119 | Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loa... | 4.3 | — | 2014-05-31 | |
| CVE-2007-1358 | Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4... | 2.6 | — | 2007-05-10 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。