Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2002-2006The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and Maven · org.apache.tomcat:tomcat · fixed in 4.1.0, 3.3a
- CVE-2002-2008Apache Tomcat 4.0.3 for Windows allows remote attackers to obtain the web root path via an HTTP request for a resource that does not exist, Maven · org.apache.tomcat:tomcat · fixed in 4.1.3
- CVE-2002-2009Apache Tomcat 4.0.1 allows remote attackers to obtain the web root path via HTTP requests for JSP files preceded by (1) +/, (2) >/, (3) </, Maven · org.apache.tomcat:tomcat
- CVE-2005-2090Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application fiMaven · org.apache.tomcat:tomcat
- CVE-2002-1148The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read souMaven · org.apache.tomcat:tomcat · fixed in 4.0.5, 4.1.12
- CVE-2002-1394Apache Tomcat 4.0.5 and earlier, when using both the invoker servlet and the default servlet, allows remote attackers to read source code foMaven · org.apache.tomcat:tomcat · fixed in 4.0.6
- CVE-2003-0043Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, uses trusted privileges when processing the web.xml file, which could allMaven · org.apache.tomcat:tomcat · fixed in 3.3.1a
- CVE-2003-0045Jakarta Tomcat before 3.3.1a on certain Windows systems may allow remote attackers to cause a denial of service (thread hang and resource coMaven · org.apache.tomcat:tomcat · fixed in 3.3.1a
- CVE-2003-0866The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service viaMaven · org.apache.tomcat:tomcat · fixed in 4.1.0
- CVE-2002-1567Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via Maven · org.apache.tomcat:tomcat · fixed in 4.1.29
- CVE-2000-1210Directory traversal vulnerability in source.jsp of Apache Tomcat before 3.1 allows remote attackers to read arbitrary files via a ..Maven · org.apache.tomcat:tomcat
- CVE-2002-0493Apache Tomcat may be started without proper security settings if errors are encountered while reading the web.xml file, which could allow atMaven · org.apache.tomcat:tomcat · fixed in 4.0b7
- CVE-2002-0935Apache Tomcat 4.0.3, and possibly other versions before 4.1.3 beta, allows remote attackers to cause a denial of service (resource exhaustioMaven · org.apache.tomcat:tomcat · fixed in 4.1.3-beta
- CVE-2002-1533Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP Maven · org.mortbay.jetty:jetty · fixed in 4.1.1
- CVE-2003-0042Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or otMaven · org.apache.tomcat:tomcat · fixed in 3.3.1a
- CVE-2003-0044Multiple cross-site scripting (XSS) vulnerabilities in the (1) examples and (2) ROOT web applications for Jakarta Tomcat 3.x through 3.3.1a Maven · org.apache.tomcat:tomcat · fixed in 3.3.2
- CVE-2001-0917Jakarta Tomcat 4.0.1 allows remote attackers to reveal physical path information by requesting a long URL with a .JSP extension.Maven · org.apache.tomcat:tomcat · fixed in 4.0.2
- CVE-2001-0590Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malMaven · org.apache.tomcat:tomcat-servlet-api · fixed in 3.2.2
- CVE-2001-0829A cross-site scripting vulnerability in Apache Tomcat 3.2.1 allows a malicious webmaster to embed Javascript in a request for a .JSP file, wMaven · org.apache.tomcat:tomcat
- CVE-2000-0759Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generatesMaven · org.apache.tomcat:tomcat