csaf_redhat - rhsa-2008

rhsa-2008_0630

Vulnerability from csaf_redhat

Published

2008-08-13 14:17

Modified

2024-11-22 02:13

Summary

Red Hat Security Advisory: Red Hat Network Satellite Server security update

Notes

Topic

Red Hat Network Satellite Server version 5.1.1 is now available. This update includes fixes for a number of security issues in Red Hat Network Satellite Server components. This update has been rated as having low security impact by the Red Hat Security Response Team.

Details

During an internal security audit, it was discovered that Red Hat Network Satellite Server shipped with an XML-RPC script, manzier.pxt, which had a single hard-coded authentication key. A remote attacker who is able to connect to the Satellite Server XML-RPC service could use this flaw to obtain limited information about Satellite Server users, such as login names, associated email addresses, internal user IDs, and partial information about entitlements. (CVE-2008-2369) This release also corrects several security vulnerabilities in various components shipped as part of Red Hat Network Satellite Server 5.1. In a typical operating environment, these components are not exposed to users of Satellite Server in a vulnerable manner. These security updates will reduce risk in unique Satellite Server environments. A denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349) Multiple cross-site scripting flaws were fixed in the image map feature in the JFreeChart package. (CVE-2007-6306) A flaw which could result in weak encryption was fixed in the perl-Crypt-CBC package. (CVE-2006-0898) Multiple flaws were fixed in the Apache Tomcat package. (CVE-2005-4838, CVE-2006-0254, CVE-2007-1355, CVE-2007-1358, CVE-2007-2449, CVE-2007-5461, CVE-2008-0128) Users of Red Hat Network Satellite Server 5.1 are advised to upgrade to 5.1.1, which resolves these issues.

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Low"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Network Satellite Server version 5.1.1 is now available. This\nupdate includes fixes for a number of security issues in Red Hat Network\nSatellite Server components.\n\nThis update has been rated as having low security impact by the Red Hat\nSecurity Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "During an internal security audit, it was discovered that Red Hat Network\nSatellite Server shipped with an XML-RPC script, manzier.pxt, which had a\nsingle hard-coded authentication key. A remote attacker who is able to\nconnect to the Satellite Server XML-RPC service could use this flaw to\nobtain limited information about Satellite Server users, such as login\nnames, associated email addresses, internal user IDs, and partial\ninformation about entitlements. (CVE-2008-2369)\n\nThis release also corrects several security vulnerabilities in various\ncomponents shipped as part of Red Hat Network Satellite Server 5.1. In a\ntypical operating environment, these components are not exposed to users\nof Satellite Server in a vulnerable manner. These security updates will\nreduce risk in unique Satellite Server environments.\n\nA denial-of-service flaw was fixed in mod_perl. (CVE-2007-1349)\n\nMultiple cross-site scripting flaws were fixed in the image map feature in\nthe JFreeChart package. (CVE-2007-6306)\n\nA flaw which could result in weak encryption was fixed in the\nperl-Crypt-CBC package. (CVE-2006-0898)\n\nMultiple flaws were fixed in the Apache Tomcat package. (CVE-2005-4838,\nCVE-2006-0254, CVE-2007-1355, CVE-2007-1358, CVE-2007-2449, CVE-2007-5461,\nCVE-2008-0128)\n\nUsers of Red Hat Network Satellite Server 5.1 are advised to upgrade to\n5.1.1, which resolves these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2008:0630",
        "url": "https://access.redhat.com/errata/RHSA-2008:0630"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#low",
        "url": "https://access.redhat.com/security/updates/classification/#low"
      },
      {
        "category": "external",
        "summary": "238401",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=238401"
      },
      {
        "category": "external",
        "summary": "240423",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=240423"
      },
      {
        "category": "external",
        "summary": "244803",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=244803"
      },
      {
        "category": "external",
        "summary": "244804",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=244804"
      },
      {
        "category": "external",
        "summary": "253166",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=253166"
      },
      {
        "category": "external",
        "summary": "333791",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=333791"
      },
      {
        "category": "external",
        "summary": "421081",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=421081"
      },
      {
        "category": "external",
        "summary": "429821",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=429821"
      },
      {
        "category": "external",
        "summary": "430522",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430522"
      },
      {
        "category": "external",
        "summary": "430646",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430646"
      },
      {
        "category": "external",
        "summary": "452461",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=452461"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0630.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Network Satellite Server security update",
    "tracking": {
      "current_release_date": "2024-11-22T02:13:53+00:00",
      "generator": {
        "date": "2024-11-22T02:13:53+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2008:0630",
      "initial_release_date": "2008-08-13T14:17:00+00:00",
      "revision_history": [
        {
          "date": "2008-08-13T14:17:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2008-08-13T10:55:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T02:13:53+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 5.1 (RHEL v.4 AS)",
                "product": {
                  "name": "Red Hat Satellite 5.1 (RHEL v.4 AS)",
                  "product_id": "4AS-RHNSAT5.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:network_satellite:5.1::el4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
                "product": {
                  "name": "mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
                  "product_id": "mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_perl-debuginfo@2.0.2-12.el4?arch=s390x"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_perl-0:2.0.2-12.el4.s390x",
                "product": {
                  "name": "mod_perl-0:2.0.2-12.el4.s390x",
                  "product_id": "mod_perl-0:2.0.2-12.el4.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_perl@2.0.2-12.el4?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_perl-debuginfo-0:2.0.2-12.el4.s390",
                "product": {
                  "name": "mod_perl-debuginfo-0:2.0.2-12.el4.s390",
                  "product_id": "mod_perl-debuginfo-0:2.0.2-12.el4.s390",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_perl-debuginfo@2.0.2-12.el4?arch=s390"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_perl-0:2.0.2-12.el4.s390",
                "product": {
                  "name": "mod_perl-0:2.0.2-12.el4.s390",
                  "product_id": "mod_perl-0:2.0.2-12.el4.s390",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_perl@2.0.2-12.el4?arch=s390"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
                "product": {
                  "name": "mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
                  "product_id": "mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_perl-debuginfo@2.0.2-12.el4?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_perl-0:2.0.2-12.el4.x86_64",
                "product": {
                  "name": "mod_perl-0:2.0.2-12.el4.x86_64",
                  "product_id": "mod_perl-0:2.0.2-12.el4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_perl@2.0.2-12.el4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mod_perl-debuginfo-0:2.0.2-12.el4.i386",
                "product": {
                  "name": "mod_perl-debuginfo-0:2.0.2-12.el4.i386",
                  "product_id": "mod_perl-debuginfo-0:2.0.2-12.el4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_perl-debuginfo@2.0.2-12.el4?arch=i386"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "mod_perl-0:2.0.2-12.el4.i386",
                "product": {
                  "name": "mod_perl-0:2.0.2-12.el4.i386",
                  "product_id": "mod_perl-0:2.0.2-12.el4.i386",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/mod_perl@2.0.2-12.el4?arch=i386"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i386"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "tomcat5-0:5.0.30-0jpp_10rh.noarch",
                "product": {
                  "name": "tomcat5-0:5.0.30-0jpp_10rh.noarch",
                  "product_id": "tomcat5-0:5.0.30-0jpp_10rh.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tomcat5@5.0.30-0jpp_10rh?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "jfreechart-0:0.9.20-3.rhn.noarch",
                "product": {
                  "name": "jfreechart-0:0.9.20-3.rhn.noarch",
                  "product_id": "jfreechart-0:0.9.20-3.rhn.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/jfreechart@0.9.20-3.rhn?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "perl-Crypt-CBC-0:2.24-1.el4.noarch",
                "product": {
                  "name": "perl-Crypt-CBC-0:2.24-1.el4.noarch",
                  "product_id": "perl-Crypt-CBC-0:2.24-1.el4.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/perl-Crypt-CBC@2.24-1.el4?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhn-html-0:5.1.1-7.noarch",
                "product": {
                  "name": "rhn-html-0:5.1.1-7.noarch",
                  "product_id": "rhn-html-0:5.1.1-7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhn-html@5.1.1-7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "jfreechart-0:0.9.20-3.rhn.noarch as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch"
        },
        "product_reference": "jfreechart-0:0.9.20-3.rhn.noarch",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_perl-0:2.0.2-12.el4.i386 as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386"
        },
        "product_reference": "mod_perl-0:2.0.2-12.el4.i386",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_perl-0:2.0.2-12.el4.s390 as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390"
        },
        "product_reference": "mod_perl-0:2.0.2-12.el4.s390",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_perl-0:2.0.2-12.el4.s390x as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x"
        },
        "product_reference": "mod_perl-0:2.0.2-12.el4.s390x",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_perl-0:2.0.2-12.el4.x86_64 as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64"
        },
        "product_reference": "mod_perl-0:2.0.2-12.el4.x86_64",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_perl-debuginfo-0:2.0.2-12.el4.i386 as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386"
        },
        "product_reference": "mod_perl-debuginfo-0:2.0.2-12.el4.i386",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_perl-debuginfo-0:2.0.2-12.el4.s390 as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390"
        },
        "product_reference": "mod_perl-debuginfo-0:2.0.2-12.el4.s390",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_perl-debuginfo-0:2.0.2-12.el4.s390x as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x"
        },
        "product_reference": "mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mod_perl-debuginfo-0:2.0.2-12.el4.x86_64 as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64"
        },
        "product_reference": "mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Crypt-CBC-0:2.24-1.el4.noarch as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch"
        },
        "product_reference": "perl-Crypt-CBC-0:2.24-1.el4.noarch",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhn-html-0:5.1.1-7.noarch as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch"
        },
        "product_reference": "rhn-html-0:5.1.1-7.noarch",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tomcat5-0:5.0.30-0jpp_10rh.noarch as a component of Red Hat Satellite 5.1 (RHEL v.4 AS)",
          "product_id": "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        },
        "product_reference": "tomcat5-0:5.0.30-0jpp_10rh.noarch",
        "relates_to_product_reference": "4AS-RHNSAT5.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2005-4838",
      "discovery_date": "2005-01-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "238401"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat manager example DoS",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2005-4838"
        },
        {
          "category": "external",
          "summary": "RHBZ#238401",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=238401"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2005-4838",
          "url": "https://www.cve.org/CVERecord?id=CVE-2005-4838"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2005-4838",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2005-4838"
        }
      ],
      "release_date": "2005-01-03T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat manager example DoS"
    },
    {
      "cve": "CVE-2006-0254",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2006-01-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430646"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat examples XSS",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-0254"
        },
        {
          "category": "external",
          "summary": "RHBZ#430646",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430646"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-0254",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-0254"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-0254",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-0254"
        }
      ],
      "release_date": "2006-01-15T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat examples XSS"
    },
    {
      "cve": "CVE-2006-0898",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "430522"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "perl-Crypt-CBC weaker encryption with some ciphers",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2006-0898"
        },
        {
          "category": "external",
          "summary": "RHBZ#430522",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=430522"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2006-0898",
          "url": "https://www.cve.org/CVERecord?id=CVE-2006-0898"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2006-0898",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2006-0898"
        }
      ],
      "release_date": "2006-02-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "perl-Crypt-CBC weaker encryption with some ciphers"
    },
    {
      "cve": "CVE-2007-1349",
      "discovery_date": "2007-05-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "240423"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "mod_perl PerlRun denial of service",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-1349"
        },
        {
          "category": "external",
          "summary": "RHBZ#240423",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=240423"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-1349",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-1349"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-1349",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-1349"
        }
      ],
      "release_date": "2007-03-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "mod_perl PerlRun denial of service"
    },
    {
      "cve": "CVE-2007-1355",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2007-05-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "253166"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat XSS in samples",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-1355"
        },
        {
          "category": "external",
          "summary": "RHBZ#253166",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=253166"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-1355",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-1355"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-1355",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-1355"
        }
      ],
      "release_date": "2007-05-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat XSS in samples"
    },
    {
      "cve": "CVE-2007-1358",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2007-04-10T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "244803"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\".",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat accept-language xss flaw",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-1358"
        },
        {
          "category": "external",
          "summary": "RHBZ#244803",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=244803"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-1358",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-1358"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-1358",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-1358"
        }
      ],
      "release_date": "2007-06-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat accept-language xss flaw"
    },
    {
      "cve": "CVE-2007-2449",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2007-05-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "244804"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the \u0027;\u0027 character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat examples jsp XSS",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-2449"
        },
        {
          "category": "external",
          "summary": "RHBZ#244804",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=244804"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-2449",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-2449"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-2449",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-2449"
        }
      ],
      "release_date": "2007-06-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "tomcat examples jsp XSS"
    },
    {
      "cve": "CVE-2007-5461",
      "discovery_date": "2007-10-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "333791"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Absolute path traversal Apache Tomcat WEBDAV",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-5461"
        },
        {
          "category": "external",
          "summary": "RHBZ#333791",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=333791"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-5461",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-5461"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-5461",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-5461"
        }
      ],
      "release_date": "2007-10-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "Absolute path traversal Apache Tomcat WEBDAV"
    },
    {
      "cve": "CVE-2007-6306",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "discovery_date": "2007-12-11T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "421081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "JFreeChart: XSS vulnerabilities in the image map feature",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2007-6306"
        },
        {
          "category": "external",
          "summary": "RHBZ#421081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=421081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2007-6306",
          "url": "https://www.cve.org/CVERecord?id=CVE-2007-6306"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2007-6306",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-6306"
        }
      ],
      "release_date": "2007-12-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "JFreeChart: XSS vulnerabilities in the image map feature"
    },
    {
      "cve": "CVE-2008-0128",
      "discovery_date": "2008-01-23T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "429821"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tomcat5 SSO cookie login information disclosure",
          "title": "Vulnerability summary"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-0128"
        },
        {
          "category": "external",
          "summary": "RHBZ#429821",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=429821"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-0128",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-0128"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-0128",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0128"
        }
      ],
      "release_date": "2006-12-20T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "tomcat5 SSO cookie login information disclosure"
    },
    {
      "cve": "CVE-2008-2369",
      "discovery_date": "2008-06-19T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "452461"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Satellite: information disclosure via manzier.pxt RPC script",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
          "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
          "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
          "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
          "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-2369"
        },
        {
          "category": "external",
          "summary": "RHBZ#452461",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=452461"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-2369",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-2369"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-2369",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-2369"
        }
      ],
      "release_date": "2008-08-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-08-13T14:17:00+00:00",
          "details": "This update is available via Red Hat Network.  Details on how to use the\nRed Hat Network to apply this update are available at\nhttp://www.redhat.com/docs/manuals/satellite/Red_Hat_Network_Satellite-5.1.0/html/Installation_Guide/s1-maintenance-update.html",
          "product_ids": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0630"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "ADJACENT_NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "4AS-RHNSAT5.1:jfreechart-0:0.9.20-3.rhn.noarch",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.i386",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.s390x",
            "4AS-RHNSAT5.1:mod_perl-debuginfo-0:2.0.2-12.el4.x86_64",
            "4AS-RHNSAT5.1:perl-Crypt-CBC-0:2.24-1.el4.noarch",
            "4AS-RHNSAT5.1:rhn-html-0:5.1.1-7.noarch",
            "4AS-RHNSAT5.1:tomcat5-0:5.0.30-0jpp_10rh.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "Satellite: information disclosure via manzier.pxt RPC script"
    }
  ]
}

cve-2006-0254

Vulnerability from cvelistv5

Published

2006-01-18 02:00

Modified

2024-08-07 16:25

Severity ?

Summary

Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.

References

▼	URL	Tags
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://www.oliverkarow.de/research/geronimo_css.txt	x_refsource_MISC
	https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181&styleName=Html&projectId=10220&Create=Create	x_refsource_CONFIRM
	http://www.securityfocus.com/bid/16260	vdb-entry, x_refsource_BID
	http://www.vupen.com/english/advisories/2006/0217	vdb-entry, x_refsource_VUPEN
	https://exchange.xforce.ibmcloud.com/vulnerabilities/24159	vdb-entry, x_refsource_XF
	https://exchange.xforce.ibmcloud.com/vulnerabilities/24158	vdb-entry, x_refsource_XF
	http://www.securityfocus.com/archive/1/421996/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	http://issues.apache.org/jira/browse/GERONIMO-1474	x_refsource_MISC
	http://secunia.com/advisories/18485	third-party-advisory, x_refsource_SECUNIA

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:25:34.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.oliverkarow.de/research/geronimo_css.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181\u0026styleName=Html\u0026projectId=10220\u0026Create=Create"
          },
          {
            "name": "16260",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/16260"
          },
          {
            "name": "ADV-2006-0217",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2006/0217"
          },
          {
            "name": "geronimo-webaccesslog-viewer-xss(24159)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24159"
          },
          {
            "name": "geronimo-jspexamples-xss(24158)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24158"
          },
          {
            "name": "20060115 Apache Geronimo 1.0 - CSS and persistent HTML-Injectionvulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/421996/100/0/threaded"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://issues.apache.org/jira/browse/GERONIMO-1474"
          },
          {
            "name": "18485",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18485"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-01-15T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-19T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.oliverkarow.de/research/geronimo_css.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181\u0026styleName=Html\u0026projectId=10220\u0026Create=Create"
        },
        {
          "name": "16260",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/16260"
        },
        {
          "name": "ADV-2006-0217",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2006/0217"
        },
        {
          "name": "geronimo-webaccesslog-viewer-xss(24159)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24159"
        },
        {
          "name": "geronimo-jspexamples-xss(24158)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24158"
        },
        {
          "name": "20060115 Apache Geronimo 1.0 - CSS and persistent HTML-Injectionvulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/421996/100/0/threaded"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://issues.apache.org/jira/browse/GERONIMO-1474"
        },
        {
          "name": "18485",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18485"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0254",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2008:0630",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
            },
            {
              "name": "31493",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31493"
            },
            {
              "name": "http://www.oliverkarow.de/research/geronimo_css.txt",
              "refsource": "MISC",
              "url": "http://www.oliverkarow.de/research/geronimo_css.txt"
            },
            {
              "name": "https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181\u0026styleName=Html\u0026projectId=10220\u0026Create=Create",
              "refsource": "CONFIRM",
              "url": "https://issues.apache.org/jira/secure/ReleaseNote.jspa?version=12310181\u0026styleName=Html\u0026projectId=10220\u0026Create=Create"
            },
            {
              "name": "16260",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/16260"
            },
            {
              "name": "ADV-2006-0217",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2006/0217"
            },
            {
              "name": "geronimo-webaccesslog-viewer-xss(24159)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24159"
            },
            {
              "name": "geronimo-jspexamples-xss(24158)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24158"
            },
            {
              "name": "20060115 Apache Geronimo 1.0 - CSS and persistent HTML-Injectionvulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/421996/100/0/threaded"
            },
            {
              "name": "RHSA-2008:0261",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
            },
            {
              "name": "http://issues.apache.org/jira/browse/GERONIMO-1474",
              "refsource": "MISC",
              "url": "http://issues.apache.org/jira/browse/GERONIMO-1474"
            },
            {
              "name": "18485",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/18485"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0254",
    "datePublished": "2006-01-18T02:00:00",
    "dateReserved": "2006-01-18T00:00:00",
    "dateUpdated": "2024-08-07T16:25:34.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2007-5461

Vulnerability from cvelistv5

Published

2007-10-15 18:00

Modified

2024-08-07 15:31

Severity ?

Summary

Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.

References

▼	URL	Tags
	http://www.debian.org/security/2008/dsa-1453	vendor-advisory, x_refsource_DEBIAN
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	http://secunia.com/advisories/30908	third-party-advisory, x_refsource_SECUNIA
	http://support.apple.com/kb/HT2163	x_refsource_CONFIRM
	http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705%40apache.org%3E	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/26070	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/27446	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=full-disclosure&m=119239530508382	mailing-list, x_refsource_FULLDISC
	http://secunia.com/advisories/30676	third-party-advisory, x_refsource_SECUNIA
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1	vendor-advisory, x_refsource_SUNALERT
	https://exchange.xforce.ibmcloud.com/vulnerabilities/37243	vdb-entry, x_refsource_XF
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202	vdb-entry, signature, x_refsource_OVAL
	http://www.redhat.com/support/errata/RHSA-2008-0862.html	vendor-advisory, x_refsource_REDHAT
	http://www.vupen.com/english/advisories/2008/1981/references	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/30899	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/29242	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2008/2823	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/37460	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2008/1979/references	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/29313	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/bid/31681	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/32120	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2007/3671	vdb-entry, x_refsource_VUPEN
	http://www.vmware.com/security/advisories/VMSA-2009-0016.html	x_refsource_CONFIRM
	http://secunia.com/advisories/27398	third-party-advisory, x_refsource_SECUNIA
	http://www.redhat.com/support/errata/RHSA-2008-0042.html	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://www.securitytracker.com/id?1018864	vdb-entry, x_refsource_SECTRACK
	http://secunia.com/advisories/28361	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/28317	third-party-advisory, x_refsource_SECUNIA
	http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html	vendor-advisory, x_refsource_APPLE
	http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2007/3674	vdb-entry, x_refsource_VUPEN
	http://www.securityfocus.com/archive/1/507985/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://tomcat.apache.org/security-6.html	x_refsource_CONFIRM
	http://secunia.com/advisories/57126	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/32222	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/30802	third-party-advisory, x_refsource_SECUNIA
	http://www.redhat.com/support/errata/RHSA-2008-0195.html	vendor-advisory, x_refsource_REDHAT
	http://security.gentoo.org/glsa/glsa-200804-10.xml	vendor-advisory, x_refsource_GENTOO
	http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2007/3622	vdb-entry, x_refsource_VUPEN
	http://www-1.ibm.com/support/docview.wss?uid=swg21286112	x_refsource_CONFIRM
	http://secunia.com/advisories/27727	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2008/1856/references	vdb-entry, x_refsource_VUPEN
	http://www.vmware.com/security/advisories/VMSA-2008-0010.html	x_refsource_CONFIRM
	http://tomcat.apache.org/security-5.html	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2008/2780	vdb-entry, x_refsource_VUPEN
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	https://www.exploit-db.com/exploits/4530	exploit, x_refsource_EXPLOIT-DB
	http://www.mandriva.com/security/advisories?name=MDVSA-2009:136	vendor-advisory, x_refsource_MANDRIVA
	http://www.debian.org/security/2008/dsa-1447	vendor-advisory, x_refsource_DEBIAN
	http://secunia.com/advisories/27481	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=bugtraq&m=139344343412337&w=2	vendor-advisory, x_refsource_HP
	http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html	vendor-advisory, x_refsource_APPLE
	http://support.apple.com/kb/HT3216	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDKSA-2007:241	vendor-advisory, x_refsource_MANDRIVA
	http://secunia.com/advisories/29711	third-party-advisory, x_refsource_SECUNIA
	http://issues.apache.org/jira/browse/GERONIMO-3549	x_refsource_MISC
	http://www.vupen.com/english/advisories/2009/3316	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/32266	third-party-advisory, x_refsource_SECUNIA
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T15:31:58.669Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "DSA-1453",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1453"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "name": "30908",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30908"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT2163"
          },
          {
            "name": "[tomcat-users] 20071015 [Security] - Important vulnerability disclosed in Apache Tomcat webdav servlet",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705%40apache.org%3E"
          },
          {
            "name": "26070",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/26070"
          },
          {
            "name": "27446",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27446"
          },
          {
            "name": "20071014 Apache Tomcat Rem0Te FiLe DiscloSure ZeroDay",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=full-disclosure\u0026m=119239530508382"
          },
          {
            "name": "30676",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30676"
          },
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "239312",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1"
          },
          {
            "name": "apache-tomcat-webdav-dir-traversal(37243)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37243"
          },
          {
            "name": "oval:org.mitre.oval:def:9202",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202"
          },
          {
            "name": "RHSA-2008:0862",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0862.html"
          },
          {
            "name": "ADV-2008-1981",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1981/references"
          },
          {
            "name": "30899",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30899"
          },
          {
            "name": "FEDORA-2007-3456",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "name": "29242",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29242"
          },
          {
            "name": "ADV-2008-2823",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2823"
          },
          {
            "name": "37460",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37460"
          },
          {
            "name": "ADV-2008-1979",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1979/references"
          },
          {
            "name": "29313",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29313"
          },
          {
            "name": "31681",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/31681"
          },
          {
            "name": "32120",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32120"
          },
          {
            "name": "ADV-2007-3671",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3671"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "27398",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27398"
          },
          {
            "name": "RHSA-2008:0042",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0042.html"
          },
          {
            "name": "SUSE-SR:2008:005",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html"
          },
          {
            "name": "1018864",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018864"
          },
          {
            "name": "28361",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28361"
          },
          {
            "name": "28317",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28317"
          },
          {
            "name": "APPLE-SA-2008-06-30",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm"
          },
          {
            "name": "ADV-2007-3674",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3674"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "SUSE-SR:2009:004",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-6.html"
          },
          {
            "name": "57126",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/57126"
          },
          {
            "name": "32222",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32222"
          },
          {
            "name": "30802",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30802"
          },
          {
            "name": "RHSA-2008:0195",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0195.html"
          },
          {
            "name": "GLSA-200804-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200804-10.xml"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html"
          },
          {
            "name": "ADV-2007-3622",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3622"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21286112"
          },
          {
            "name": "27727",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27727"
          },
          {
            "name": "ADV-2008-1856",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1856/references"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2008-0010.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "name": "ADV-2008-2780",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2780"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "name": "4530",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/4530"
          },
          {
            "name": "MDVSA-2009:136",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
          },
          {
            "name": "DSA-1447",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1447"
          },
          {
            "name": "27481",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27481"
          },
          {
            "name": "HPSBST02955",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
          },
          {
            "name": "APPLE-SA-2008-10-09",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT3216"
          },
          {
            "name": "MDKSA-2007:241",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:241"
          },
          {
            "name": "29711",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29711"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://issues.apache.org/jira/browse/GERONIMO-3549"
          },
          {
            "name": "ADV-2009-3316",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3316"
          },
          {
            "name": "32266",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/32266"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-10-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:08:49",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "DSA-1453",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1453"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "name": "30908",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30908"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT2163"
        },
        {
          "name": "[tomcat-users] 20071015 [Security] - Important vulnerability disclosed in Apache Tomcat webdav servlet",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705%40apache.org%3E"
        },
        {
          "name": "26070",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/26070"
        },
        {
          "name": "27446",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27446"
        },
        {
          "name": "20071014 Apache Tomcat Rem0Te FiLe DiscloSure ZeroDay",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://marc.info/?l=full-disclosure\u0026m=119239530508382"
        },
        {
          "name": "30676",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30676"
        },
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "239312",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1"
        },
        {
          "name": "apache-tomcat-webdav-dir-traversal(37243)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37243"
        },
        {
          "name": "oval:org.mitre.oval:def:9202",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202"
        },
        {
          "name": "RHSA-2008:0862",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0862.html"
        },
        {
          "name": "ADV-2008-1981",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1981/references"
        },
        {
          "name": "30899",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30899"
        },
        {
          "name": "FEDORA-2007-3456",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "name": "29242",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29242"
        },
        {
          "name": "ADV-2008-2823",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2823"
        },
        {
          "name": "37460",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37460"
        },
        {
          "name": "ADV-2008-1979",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1979/references"
        },
        {
          "name": "29313",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29313"
        },
        {
          "name": "31681",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/31681"
        },
        {
          "name": "32120",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32120"
        },
        {
          "name": "ADV-2007-3671",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3671"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "27398",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27398"
        },
        {
          "name": "RHSA-2008:0042",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0042.html"
        },
        {
          "name": "SUSE-SR:2008:005",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html"
        },
        {
          "name": "1018864",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018864"
        },
        {
          "name": "28361",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28361"
        },
        {
          "name": "28317",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28317"
        },
        {
          "name": "APPLE-SA-2008-06-30",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm"
        },
        {
          "name": "ADV-2007-3674",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3674"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "SUSE-SR:2009:004",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-6.html"
        },
        {
          "name": "57126",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/57126"
        },
        {
          "name": "32222",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32222"
        },
        {
          "name": "30802",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30802"
        },
        {
          "name": "RHSA-2008:0195",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0195.html"
        },
        {
          "name": "GLSA-200804-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200804-10.xml"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html"
        },
        {
          "name": "ADV-2007-3622",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3622"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21286112"
        },
        {
          "name": "27727",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27727"
        },
        {
          "name": "ADV-2008-1856",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1856/references"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2008-0010.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-5.html"
        },
        {
          "name": "ADV-2008-2780",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2780"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "name": "4530",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/4530"
        },
        {
          "name": "MDVSA-2009:136",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
        },
        {
          "name": "DSA-1447",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1447"
        },
        {
          "name": "27481",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27481"
        },
        {
          "name": "HPSBST02955",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
        },
        {
          "name": "APPLE-SA-2008-10-09",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT3216"
        },
        {
          "name": "MDKSA-2007:241",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:241"
        },
        {
          "name": "29711",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29711"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://issues.apache.org/jira/browse/GERONIMO-3549"
        },
        {
          "name": "ADV-2009-3316",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3316"
        },
        {
          "name": "32266",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/32266"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf%40%3Cdev.tomcat.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2007-5461",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "DSA-1453",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2008/dsa-1453"
            },
            {
              "name": "http://tomcat.apache.org/security-4.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-4.html"
            },
            {
              "name": "30908",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30908"
            },
            {
              "name": "http://support.apple.com/kb/HT2163",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT2163"
            },
            {
              "name": "[tomcat-users] 20071015 [Security] - Important vulnerability disclosed in Apache Tomcat webdav servlet",
              "refsource": "MLIST",
              "url": "http://mail-archives.apache.org/mod_mbox/tomcat-users/200710.mbox/%3C47135C2D.1000705@apache.org%3E"
            },
            {
              "name": "26070",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/26070"
            },
            {
              "name": "27446",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27446"
            },
            {
              "name": "20071014 Apache Tomcat Rem0Te FiLe DiscloSure ZeroDay",
              "refsource": "FULLDISC",
              "url": "http://marc.info/?l=full-disclosure\u0026m=119239530508382"
            },
            {
              "name": "30676",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30676"
            },
            {
              "name": "RHSA-2008:0630",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
            },
            {
              "name": "239312",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1"
            },
            {
              "name": "apache-tomcat-webdav-dir-traversal(37243)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/37243"
            },
            {
              "name": "oval:org.mitre.oval:def:9202",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9202"
            },
            {
              "name": "RHSA-2008:0862",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0862.html"
            },
            {
              "name": "ADV-2008-1981",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1981/references"
            },
            {
              "name": "30899",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30899"
            },
            {
              "name": "FEDORA-2007-3456",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
            },
            {
              "name": "31493",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31493"
            },
            {
              "name": "29242",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29242"
            },
            {
              "name": "ADV-2008-2823",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2823"
            },
            {
              "name": "37460",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/37460"
            },
            {
              "name": "ADV-2008-1979",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1979/references"
            },
            {
              "name": "29313",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29313"
            },
            {
              "name": "31681",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/31681"
            },
            {
              "name": "32120",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32120"
            },
            {
              "name": "ADV-2007-3671",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3671"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
            },
            {
              "name": "27398",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27398"
            },
            {
              "name": "RHSA-2008:0042",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0042.html"
            },
            {
              "name": "SUSE-SR:2008:005",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html"
            },
            {
              "name": "1018864",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1018864"
            },
            {
              "name": "28361",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/28361"
            },
            {
              "name": "28317",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/28317"
            },
            {
              "name": "APPLE-SA-2008-06-30",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
            },
            {
              "name": "http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm",
              "refsource": "CONFIRM",
              "url": "http://support.avaya.com/elmodocs2/security/ASA-2008-401.htm"
            },
            {
              "name": "ADV-2007-3674",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3674"
            },
            {
              "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
            },
            {
              "name": "SUSE-SR:2009:004",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"
            },
            {
              "name": "http://tomcat.apache.org/security-6.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-6.html"
            },
            {
              "name": "57126",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/57126"
            },
            {
              "name": "32222",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32222"
            },
            {
              "name": "30802",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30802"
            },
            {
              "name": "RHSA-2008:0195",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0195.html"
            },
            {
              "name": "GLSA-200804-10",
              "refsource": "GENTOO",
              "url": "http://security.gentoo.org/glsa/glsa-200804-10.xml"
            },
            {
              "name": "http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html",
              "refsource": "CONFIRM",
              "url": "http://geronimo.apache.org/2007/10/18/potential-vulnerability-in-apache-tomcat-webdav-servlet.html"
            },
            {
              "name": "ADV-2007-3622",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3622"
            },
            {
              "name": "http://www-1.ibm.com/support/docview.wss?uid=swg21286112",
              "refsource": "CONFIRM",
              "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21286112"
            },
            {
              "name": "27727",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27727"
            },
            {
              "name": "ADV-2008-1856",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1856/references"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2008-0010.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2008-0010.html"
            },
            {
              "name": "http://tomcat.apache.org/security-5.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-5.html"
            },
            {
              "name": "ADV-2008-2780",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2780"
            },
            {
              "name": "RHSA-2008:0261",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
            },
            {
              "name": "4530",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/4530"
            },
            {
              "name": "MDVSA-2009:136",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:136"
            },
            {
              "name": "DSA-1447",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2008/dsa-1447"
            },
            {
              "name": "27481",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27481"
            },
            {
              "name": "HPSBST02955",
              "refsource": "HP",
              "url": "http://marc.info/?l=bugtraq\u0026m=139344343412337\u0026w=2"
            },
            {
              "name": "APPLE-SA-2008-10-09",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2008/Oct/msg00001.html"
            },
            {
              "name": "http://support.apple.com/kb/HT3216",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT3216"
            },
            {
              "name": "MDKSA-2007:241",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:241"
            },
            {
              "name": "29711",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29711"
            },
            {
              "name": "http://issues.apache.org/jira/browse/GERONIMO-3549",
              "refsource": "MISC",
              "url": "http://issues.apache.org/jira/browse/GERONIMO-3549"
            },
            {
              "name": "ADV-2009-3316",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/3316"
            },
            {
              "name": "32266",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/32266"
            },
            {
              "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200203 svn commit: r1873527 [22/30] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r584a714f141eff7b1c358d4679288177bd4ca4558e9999d15867d4b5@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200213 svn commit: r1873980 [25/34] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r3aacc40356defc3f248aa504b1e48e819dd0471a0a83349080c6bcbf@%3Cdev.tomcat.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-5461",
    "datePublished": "2007-10-15T18:00:00",
    "dateReserved": "2007-10-15T00:00:00",
    "dateUpdated": "2024-08-07T15:31:58.669Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2007-1358

Vulnerability from cvelistv5

Published

2007-05-09 22:00

Modified

2024-08-07 12:50

Severity ?

Summary

Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".

References

▼	URL	Tags
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	http://secunia.com/advisories/30908	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/25721	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2007/2732	vdb-entry, x_refsource_VUPEN
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1	vendor-advisory, x_refsource_SUNALERT
	http://www.vupen.com/english/advisories/2007/3087	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/30899	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2008/1979/references	vdb-entry, x_refsource_VUPEN
	http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html	vendor-advisory, x_refsource_APPLE
	http://www.securityfocus.com/archive/1/500412/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/33668	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/archive/1/500396/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.vupen.com/english/advisories/2007/1729	vdb-entry, x_refsource_VUPEN
	http://osvdb.org/34881	vdb-entry, x_refsource_OSVDB
	http://www.securityfocus.com/bid/24524	vdb-entry, x_refsource_BID
	http://www.vupen.com/english/advisories/2009/0233	vdb-entry, x_refsource_VUPEN
	http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html	x_refsource_CONFIRM
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10679	vdb-entry, signature, x_refsource_OVAL
	http://www.vupen.com/english/advisories/2007/3386	vdb-entry, x_refsource_VUPEN
	http://www.securityfocus.com/archive/1/471719/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/27037	third-party-advisory, x_refsource_SECUNIA
	http://docs.info.apple.com/article.html?artnum=306172	x_refsource_CONFIRM
	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/27727	third-party-advisory, x_refsource_SECUNIA
	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	vendor-advisory, x_refsource_HP
	http://jvn.jp/jp/JVN%2316535199/index.html	third-party-advisory, x_refsource_JVN
	http://www.securityfocus.com/bid/25159	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/26660	third-party-advisory, x_refsource_SECUNIA
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	http://www.securitytracker.com/id?1018269	vdb-entry, x_refsource_SECTRACK
	http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx	x_refsource_CONFIRM
	http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540	x_refsource_CONFIRM
	http://secunia.com/advisories/26235	third-party-advisory, x_refsource_SECUNIA
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T12:50:35.295Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "name": "30908",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30908"
          },
          {
            "name": "25721",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25721"
          },
          {
            "name": "ADV-2007-2732",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2732"
          },
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "239312",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1"
          },
          {
            "name": "ADV-2007-3087",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3087"
          },
          {
            "name": "30899",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30899"
          },
          {
            "name": "FEDORA-2007-3456",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "name": "ADV-2008-1979",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1979/references"
          },
          {
            "name": "APPLE-SA-2007-07-31",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
          },
          {
            "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
          },
          {
            "name": "33668",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33668"
          },
          {
            "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
          },
          {
            "name": "ADV-2007-1729",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/1729"
          },
          {
            "name": "34881",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/34881"
          },
          {
            "name": "24524",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24524"
          },
          {
            "name": "ADV-2009-0233",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0233"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html"
          },
          {
            "name": "oval:org.mitre.oval:def:10679",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10679"
          },
          {
            "name": "ADV-2007-3386",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3386"
          },
          {
            "name": "20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/471719/100/0/threaded"
          },
          {
            "name": "27037",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27037"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://docs.info.apple.com/article.html?artnum=306172"
          },
          {
            "name": "SSRT071447",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
          },
          {
            "name": "27727",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27727"
          },
          {
            "name": "HPSBUX02262",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
          },
          {
            "name": "JVN#16535199",
            "tags": [
              "third-party-advisory",
              "x_refsource_JVN",
              "x_transferred"
            ],
            "url": "http://jvn.jp/jp/JVN%2316535199/index.html"
          },
          {
            "name": "25159",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/25159"
          },
          {
            "name": "26660",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26660"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "name": "1018269",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018269"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
          },
          {
            "name": "26235",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26235"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-09T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:07:57",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "name": "30908",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30908"
        },
        {
          "name": "25721",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25721"
        },
        {
          "name": "ADV-2007-2732",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2732"
        },
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "239312",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1"
        },
        {
          "name": "ADV-2007-3087",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3087"
        },
        {
          "name": "30899",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30899"
        },
        {
          "name": "FEDORA-2007-3456",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "name": "ADV-2008-1979",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1979/references"
        },
        {
          "name": "APPLE-SA-2007-07-31",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
        },
        {
          "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
        },
        {
          "name": "33668",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33668"
        },
        {
          "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
        },
        {
          "name": "ADV-2007-1729",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/1729"
        },
        {
          "name": "34881",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/34881"
        },
        {
          "name": "24524",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24524"
        },
        {
          "name": "ADV-2009-0233",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0233"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html"
        },
        {
          "name": "oval:org.mitre.oval:def:10679",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10679"
        },
        {
          "name": "ADV-2007-3386",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3386"
        },
        {
          "name": "20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/471719/100/0/threaded"
        },
        {
          "name": "27037",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27037"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://docs.info.apple.com/article.html?artnum=306172"
        },
        {
          "name": "SSRT071447",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
        },
        {
          "name": "27727",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27727"
        },
        {
          "name": "HPSBUX02262",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
        },
        {
          "name": "JVN#16535199",
          "tags": [
            "third-party-advisory",
            "x_refsource_JVN"
          ],
          "url": "http://jvn.jp/jp/JVN%2316535199/index.html"
        },
        {
          "name": "25159",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/25159"
        },
        {
          "name": "26660",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26660"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "name": "1018269",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018269"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
        },
        {
          "name": "26235",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26235"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2007-1358",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted \"Accept-Language headers that do not conform to RFC 2616\"."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://tomcat.apache.org/security-4.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-4.html"
            },
            {
              "name": "30908",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30908"
            },
            {
              "name": "25721",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/25721"
            },
            {
              "name": "ADV-2007-2732",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2732"
            },
            {
              "name": "RHSA-2008:0630",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
            },
            {
              "name": "239312",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1"
            },
            {
              "name": "ADV-2007-3087",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3087"
            },
            {
              "name": "30899",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30899"
            },
            {
              "name": "FEDORA-2007-3456",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
            },
            {
              "name": "31493",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31493"
            },
            {
              "name": "ADV-2008-1979",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1979/references"
            },
            {
              "name": "APPLE-SA-2007-07-31",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html"
            },
            {
              "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
            },
            {
              "name": "33668",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33668"
            },
            {
              "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
            },
            {
              "name": "ADV-2007-1729",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/1729"
            },
            {
              "name": "34881",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/34881"
            },
            {
              "name": "24524",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24524"
            },
            {
              "name": "ADV-2009-0233",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0233"
            },
            {
              "name": "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html",
              "refsource": "CONFIRM",
              "url": "http://www.fujitsu.com/global/support/software/security/products-f/interstage-200704e.html"
            },
            {
              "name": "oval:org.mitre.oval:def:10679",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10679"
            },
            {
              "name": "ADV-2007-3386",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3386"
            },
            {
              "name": "20070618 [CVE-2007-1358] Apache Tomcat XSS vulnerability in Accept-Language header processing",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/471719/100/0/threaded"
            },
            {
              "name": "27037",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27037"
            },
            {
              "name": "http://docs.info.apple.com/article.html?artnum=306172",
              "refsource": "CONFIRM",
              "url": "http://docs.info.apple.com/article.html?artnum=306172"
            },
            {
              "name": "SSRT071447",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
            },
            {
              "name": "27727",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27727"
            },
            {
              "name": "HPSBUX02262",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
            },
            {
              "name": "JVN#16535199",
              "refsource": "JVN",
              "url": "http://jvn.jp/jp/JVN%2316535199/index.html"
            },
            {
              "name": "25159",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/25159"
            },
            {
              "name": "26660",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26660"
            },
            {
              "name": "RHSA-2008:0261",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
            },
            {
              "name": "1018269",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1018269"
            },
            {
              "name": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx",
              "refsource": "CONFIRM",
              "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
            },
            {
              "name": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540",
              "refsource": "CONFIRM",
              "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
            },
            {
              "name": "26235",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26235"
            },
            {
              "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-1358",
    "datePublished": "2007-05-09T22:00:00",
    "dateReserved": "2007-03-08T00:00:00",
    "dateUpdated": "2024-08-07T12:50:35.295Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2008-2369

Vulnerability from cvelistv5

Published

2008-08-14 20:00

Modified

2024-08-07 08:58

Severity ?

Summary

manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements.

References

▼	URL	Tags
	http://securitytracker.com/id?1020694	vdb-entry, x_refsource_SECTRACK
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilities/44452	vdb-entry, x_refsource_XF
	http://www.securityfocus.com/bid/30679	vdb-entry, x_refsource_BID

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T08:58:01.815Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1020694",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1020694"
          },
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "name": "rhnss-manzier-information-disclosure(44452)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44452"
          },
          {
            "name": "30679",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30679"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-08-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "manzier.pxt in Red Hat Network Satellite Server before 5.1.1 has a hard-coded authentication key, which allows remote attackers to connect to the server and obtain sensitive information about user accounts and entitlements."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-07T12:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "1020694",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1020694"
        },
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "name": "rhnss-manzier-information-disclosure(44452)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44452"
        },
        {
          "name": "30679",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30679"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2008-2369",
    "datePublished": "2008-08-14T20:00:00",
    "dateReserved": "2008-05-21T00:00:00",
    "dateUpdated": "2024-08-07T08:58:01.815Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2005-4838

Vulnerability from cvelistv5

Published

2007-04-25 21:00

Modified

2024-08-08 00:01

Severity ?

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.

References

▼	URL	Tags
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	https://exchange.xforce.ibmcloud.com/vulnerabilities/36467	vdb-entry, x_refsource_XF
	http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065598.html	mailing-list, x_refsource_FULLDISC
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://www.osvdb.org/34878	vdb-entry, x_refsource_OSVDB
	http://www.osvdb.org/12721	vdb-entry, x_refsource_OSVDB
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://marc.info/?l=tomcat-dev&m=110477195116951&w=2	mailing-list, x_refsource_MLIST
	http://www.osvdb.org/34879	vdb-entry, x_refsource_OSVDB
	http://securitytracker.com/id?1012793	vdb-entry, x_refsource_SECTRACK
	http://secunia.com/advisories/13737	third-party-advisory, x_refsource_SECUNIA
	http://www.oliverkarow.de/research/jakarta556_xss.txt	x_refsource_MISC
	http://tomcat.apache.org/security-5.html	x_refsource_CONFIRM
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	http://marc.info/?l=tomcat-dev&m=110476790331536&w=2	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-08T00:01:23.311Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "name": "tomcat-functions-xss(36467)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36467"
          },
          {
            "name": "20070906 Apache Tomcat remote xss",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065598.html"
          },
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "34878",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/34878"
          },
          {
            "name": "12721",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/12721"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "name": "[tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=tomcat-dev\u0026m=110477195116951\u0026w=2"
          },
          {
            "name": "34879",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://www.osvdb.org/34879"
          },
          {
            "name": "1012793",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1012793"
          },
          {
            "name": "13737",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/13737"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.oliverkarow.de/research/jakarta556_xss.txt"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "name": "[tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://marc.info/?l=tomcat-dev\u0026m=110476790331536\u0026w=2"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2005-01-03T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp.  NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:08:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "name": "tomcat-functions-xss(36467)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36467"
        },
        {
          "name": "20070906 Apache Tomcat remote xss",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065598.html"
        },
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "34878",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/34878"
        },
        {
          "name": "12721",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/12721"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "name": "[tomcat-dev] 20050103 [PATCH jakarta-servletapi-5] Re: Fwd: XSS in Jakarta Tomcat 5.5.6",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=tomcat-dev\u0026m=110477195116951\u0026w=2"
        },
        {
          "name": "34879",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://www.osvdb.org/34879"
        },
        {
          "name": "1012793",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1012793"
        },
        {
          "name": "13737",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/13737"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.oliverkarow.de/research/jakarta556_xss.txt"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-5.html"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "name": "[tomcat-dev] 20050103 Re: Fwd: XSS in Jakarta Tomcat 5.5.6",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://marc.info/?l=tomcat-dev\u0026m=110476790331536\u0026w=2"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2005-4838",
    "datePublished": "2007-04-25T21:00:00",
    "dateReserved": "2007-04-25T00:00:00",
    "dateUpdated": "2024-08-08T00:01:23.311Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2007-2449

Vulnerability from cvelistv5

Published

2007-06-14 23:00

Modified

2024-08-07 13:42

Severity ?

Summary

Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a "snp/snoop.jsp;" sequence.

References

▼	URL	Tags
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	http://support.apple.com/kb/HT2163	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://www.vupen.com/english/advisories/2008/1981/references	vdb-entry, x_refsource_VUPEN
	https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html	vendor-advisory, x_refsource_FEDORA
	http://www.securityfocus.com/bid/24476	vdb-entry, x_refsource_BID
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/archive/1/471351/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://securityreason.com/securityalert/2804	third-party-advisory, x_refsource_SREASON
	http://www.redhat.com/support/errata/RHSA-2007-0569.html	vendor-advisory, x_refsource_REDHAT
	https://exchange.xforce.ibmcloud.com/vulnerabilities/34869	vdb-entry, x_refsource_XF
	http://www.securityfocus.com/archive/1/500412/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.securitytracker.com/id?1018245	vdb-entry, x_refsource_SECTRACK
	http://secunia.com/advisories/33668	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/29392	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/archive/1/500396/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html	vendor-advisory, x_refsource_SUSE
	http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html	vendor-advisory, x_refsource_APPLE
	http://www.vupen.com/english/advisories/2009/0233	vdb-entry, x_refsource_VUPEN
	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html	vendor-advisory, x_refsource_SUSE
	http://tomcat.apache.org/security-6.html	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2007/3386	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/30802	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/27037	third-party-advisory, x_refsource_SECUNIA
	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/27727	third-party-advisory, x_refsource_SECUNIA
	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	vendor-advisory, x_refsource_HP
	http://tomcat.apache.org/security-5.html	x_refsource_CONFIRM
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	http://osvdb.org/36080	vdb-entry, x_refsource_OSVDB
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10578	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/26076	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2007/2213	vdb-entry, x_refsource_VUPEN
	http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx	x_refsource_CONFIRM
	http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540	x_refsource_CONFIRM
	http://www.mandriva.com/security/advisories?name=MDKSA-2007:241	vendor-advisory, x_refsource_MANDRIVA
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T13:42:33.408Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT2163"
          },
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "ADV-2008-1981",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1981/references"
          },
          {
            "name": "FEDORA-2007-3456",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
          },
          {
            "name": "24476",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24476"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "name": "20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/471351/100/0/threaded"
          },
          {
            "name": "2804",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2804"
          },
          {
            "name": "RHSA-2007:0569",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2007-0569.html"
          },
          {
            "name": "tomcat-example-xss(34869)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34869"
          },
          {
            "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
          },
          {
            "name": "1018245",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018245"
          },
          {
            "name": "33668",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33668"
          },
          {
            "name": "29392",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29392"
          },
          {
            "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
          },
          {
            "name": "SUSE-SR:2008:007",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html"
          },
          {
            "name": "APPLE-SA-2008-06-30",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
          },
          {
            "name": "ADV-2009-0233",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0233"
          },
          {
            "name": "SUSE-SR:2009:004",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-6.html"
          },
          {
            "name": "ADV-2007-3386",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3386"
          },
          {
            "name": "30802",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30802"
          },
          {
            "name": "27037",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27037"
          },
          {
            "name": "SSRT071447",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
          },
          {
            "name": "27727",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27727"
          },
          {
            "name": "HPSBUX02262",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "name": "36080",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/36080"
          },
          {
            "name": "oval:org.mitre.oval:def:10578",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10578"
          },
          {
            "name": "26076",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26076"
          },
          {
            "name": "ADV-2007-2213",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2213"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
          },
          {
            "name": "MDKSA-2007:241",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:241"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-06-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the \u0027;\u0027 character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:07:33",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT2163"
        },
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "ADV-2008-1981",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1981/references"
        },
        {
          "name": "FEDORA-2007-3456",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
        },
        {
          "name": "24476",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24476"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "name": "20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/471351/100/0/threaded"
        },
        {
          "name": "2804",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2804"
        },
        {
          "name": "RHSA-2007:0569",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2007-0569.html"
        },
        {
          "name": "tomcat-example-xss(34869)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34869"
        },
        {
          "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
        },
        {
          "name": "1018245",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018245"
        },
        {
          "name": "33668",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33668"
        },
        {
          "name": "29392",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29392"
        },
        {
          "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
        },
        {
          "name": "SUSE-SR:2008:007",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html"
        },
        {
          "name": "APPLE-SA-2008-06-30",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
        },
        {
          "name": "ADV-2009-0233",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0233"
        },
        {
          "name": "SUSE-SR:2009:004",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-6.html"
        },
        {
          "name": "ADV-2007-3386",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3386"
        },
        {
          "name": "30802",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30802"
        },
        {
          "name": "27037",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27037"
        },
        {
          "name": "SSRT071447",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
        },
        {
          "name": "27727",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27727"
        },
        {
          "name": "HPSBUX02262",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-5.html"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "name": "36080",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/36080"
        },
        {
          "name": "oval:org.mitre.oval:def:10578",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10578"
        },
        {
          "name": "26076",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26076"
        },
        {
          "name": "ADV-2007-2213",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2213"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
        },
        {
          "name": "MDKSA-2007:241",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:241"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2007-2449",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the \u0027;\u0027 character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://tomcat.apache.org/security-4.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-4.html"
            },
            {
              "name": "http://support.apple.com/kb/HT2163",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT2163"
            },
            {
              "name": "RHSA-2008:0630",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
            },
            {
              "name": "ADV-2008-1981",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1981/references"
            },
            {
              "name": "FEDORA-2007-3456",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
            },
            {
              "name": "24476",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24476"
            },
            {
              "name": "31493",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31493"
            },
            {
              "name": "20070614 [CVE-2007-2449] Apache Tomcat XSS vulnerabilities in the JSP examples",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/471351/100/0/threaded"
            },
            {
              "name": "2804",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/2804"
            },
            {
              "name": "RHSA-2007:0569",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2007-0569.html"
            },
            {
              "name": "tomcat-example-xss(34869)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34869"
            },
            {
              "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
            },
            {
              "name": "1018245",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1018245"
            },
            {
              "name": "33668",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33668"
            },
            {
              "name": "29392",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29392"
            },
            {
              "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
            },
            {
              "name": "SUSE-SR:2008:007",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00008.html"
            },
            {
              "name": "APPLE-SA-2008-06-30",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
            },
            {
              "name": "ADV-2009-0233",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0233"
            },
            {
              "name": "SUSE-SR:2009:004",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html"
            },
            {
              "name": "http://tomcat.apache.org/security-6.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-6.html"
            },
            {
              "name": "ADV-2007-3386",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3386"
            },
            {
              "name": "30802",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30802"
            },
            {
              "name": "27037",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27037"
            },
            {
              "name": "SSRT071447",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
            },
            {
              "name": "27727",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27727"
            },
            {
              "name": "HPSBUX02262",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
            },
            {
              "name": "http://tomcat.apache.org/security-5.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-5.html"
            },
            {
              "name": "RHSA-2008:0261",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
            },
            {
              "name": "36080",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/36080"
            },
            {
              "name": "oval:org.mitre.oval:def:10578",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10578"
            },
            {
              "name": "26076",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26076"
            },
            {
              "name": "ADV-2007-2213",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2213"
            },
            {
              "name": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx",
              "refsource": "CONFIRM",
              "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
            },
            {
              "name": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540",
              "refsource": "CONFIRM",
              "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
            },
            {
              "name": "MDKSA-2007:241",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:241"
            },
            {
              "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190319 svn commit: r1855831 [22/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/06cfb634bc7bf37af7d8f760f118018746ad8efbd519c4b789ac9c2e@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190325 svn commit: r1856174 [20/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/8dcaf7c3894d66cb717646ea1504ea6e300021c85bb4e677dc16b1aa@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-2449",
    "datePublished": "2007-06-14T23:00:00",
    "dateReserved": "2007-05-02T00:00:00",
    "dateUpdated": "2024-08-07T13:42:33.408Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2007-1349

Vulnerability from cvelistv5

Published

2007-03-30 00:00

Modified

2024-08-07 12:50

Severity ?

Summary

PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI.

References

▼	URL	Tags
	http://secunia.com/advisories/26231	third-party-advisory, x_refsource_SECUNIA
	http://www.securitytracker.com/id?1018259	vdb-entry, x_refsource_SECTRACK
	http://secunia.com/advisories/25894	third-party-advisory, x_refsource_SECUNIA
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://rhn.redhat.com/errata/RHSA-2007-0395.html	vendor-advisory, x_refsource_REDHAT
	http://www.redhat.com/support/errata/RHSA-2007-0486.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://www.gossamer-threads.com/lists/modperl/modperl/92739	x_refsource_MISC
	http://www.redhat.com/support/errata/RHSA-2008-0627.html	vendor-advisory, x_refsource_REDHAT
	http://svn.apache.org/repos/asf/perl/modperl/branches/1.x/Changes	x_refsource_CONFIRM
	http://secunia.com/advisories/24839	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/33720	third-party-advisory, x_refsource_SECUNIA
	http://www.ubuntu.com/usn/usn-488-1	vendor-advisory, x_refsource_UBUNTU
	http://secunia.com/advisories/31490	third-party-advisory, x_refsource_SECUNIA
	http://www.novell.com/linux/security/advisories/2007_12_sr.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/26084	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2007/1150	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/25655	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021508.1-1	vendor-advisory, x_refsource_SUNALERT
	http://support.avaya.com/elmodocs2/security/ASA-2007-293.htm	x_refsource_CONFIRM
	http://secunia.com/advisories/24678	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/25110	third-party-advisory, x_refsource_SECUNIA
	http://www.redhat.com/support/errata/RHSA-2007-0396.html	vendor-advisory, x_refsource_REDHAT
	http://www.trustix.org/errata/2007/0023/	vendor-advisory, x_refsource_TRUSTIX
	http://www.mandriva.com/security/advisories?name=MDKSA-2007:083	vendor-advisory, x_refsource_MANDRIVA
	http://secunia.com/advisories/33723	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/25730	third-party-advisory, x_refsource_SECUNIA
	http://www.novell.com/linux/security/advisories/2007_8_sr.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/26290	third-party-advisory, x_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilities/33312	vdb-entry, x_refsource_XF
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	http://security.gentoo.org/glsa/glsa-200705-04.xml	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/23192	vdb-entry, x_refsource_BID
	ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc	vendor-advisory, x_refsource_SGI
	http://secunia.com/advisories/25072	third-party-advisory, x_refsource_SECUNIA
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10987	vdb-entry, signature, x_refsource_OVAL
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8349	vdb-entry, signature, x_refsource_OVAL
	http://secunia.com/advisories/25432	third-party-advisory, x_refsource_SECUNIA
	http://sunsolve.sun.com/search/document.do?assetkey=1-66-248386-1	vendor-advisory, x_refsource_SUNALERT

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T12:50:35.306Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "26231",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26231"
          },
          {
            "name": "1018259",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018259"
          },
          {
            "name": "25894",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25894"
          },
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "RHSA-2007:0395",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2007-0395.html"
          },
          {
            "name": "RHSA-2007:0486",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2007-0486.html"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.gossamer-threads.com/lists/modperl/modperl/92739"
          },
          {
            "name": "RHSA-2008:0627",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0627.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://svn.apache.org/repos/asf/perl/modperl/branches/1.x/Changes"
          },
          {
            "name": "24839",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/24839"
          },
          {
            "name": "33720",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33720"
          },
          {
            "name": "USN-488-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-488-1"
          },
          {
            "name": "31490",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31490"
          },
          {
            "name": "SUSE-SR:2007:012",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2007_12_sr.html"
          },
          {
            "name": "26084",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26084"
          },
          {
            "name": "ADV-2007-1150",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/1150"
          },
          {
            "name": "25655",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25655"
          },
          {
            "name": "1021508",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021508.1-1"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-293.htm"
          },
          {
            "name": "24678",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/24678"
          },
          {
            "name": "25110",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25110"
          },
          {
            "name": "RHSA-2007:0396",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2007-0396.html"
          },
          {
            "name": "2007-0023",
            "tags": [
              "vendor-advisory",
              "x_refsource_TRUSTIX",
              "x_transferred"
            ],
            "url": "http://www.trustix.org/errata/2007/0023/"
          },
          {
            "name": "MDKSA-2007:083",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:083"
          },
          {
            "name": "33723",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33723"
          },
          {
            "name": "25730",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25730"
          },
          {
            "name": "SUSE-SR:2007:008",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2007_8_sr.html"
          },
          {
            "name": "26290",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26290"
          },
          {
            "name": "modperl-pathinfo-dos(33312)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33312"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "name": "GLSA-200705-04",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200705-04.xml"
          },
          {
            "name": "23192",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/23192"
          },
          {
            "name": "20070602-01-P",
            "tags": [
              "vendor-advisory",
              "x_refsource_SGI",
              "x_transferred"
            ],
            "url": "ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc"
          },
          {
            "name": "25072",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25072"
          },
          {
            "name": "oval:org.mitre.oval:def:10987",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10987"
          },
          {
            "name": "oval:org.mitre.oval:def:8349",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8349"
          },
          {
            "name": "25432",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25432"
          },
          {
            "name": "248386",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-248386-1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-03-29T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in mod_perl 2.x, does not properly escape PATH_INFO before use in a regular expression, which allows remote attackers to cause a denial of service (resource consumption) via a crafted URI."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-10-10T00:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "26231",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26231"
        },
        {
          "name": "1018259",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018259"
        },
        {
          "name": "25894",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25894"
        },
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "RHSA-2007:0395",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2007-0395.html"
        },
        {
          "name": "RHSA-2007:0486",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2007-0486.html"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.gossamer-threads.com/lists/modperl/modperl/92739"
        },
        {
          "name": "RHSA-2008:0627",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0627.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://svn.apache.org/repos/asf/perl/modperl/branches/1.x/Changes"
        },
        {
          "name": "24839",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/24839"
        },
        {
          "name": "33720",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33720"
        },
        {
          "name": "USN-488-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-488-1"
        },
        {
          "name": "31490",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31490"
        },
        {
          "name": "SUSE-SR:2007:012",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2007_12_sr.html"
        },
        {
          "name": "26084",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26084"
        },
        {
          "name": "ADV-2007-1150",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/1150"
        },
        {
          "name": "25655",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25655"
        },
        {
          "name": "1021508",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021508.1-1"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.avaya.com/elmodocs2/security/ASA-2007-293.htm"
        },
        {
          "name": "24678",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/24678"
        },
        {
          "name": "25110",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25110"
        },
        {
          "name": "RHSA-2007:0396",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2007-0396.html"
        },
        {
          "name": "2007-0023",
          "tags": [
            "vendor-advisory",
            "x_refsource_TRUSTIX"
          ],
          "url": "http://www.trustix.org/errata/2007/0023/"
        },
        {
          "name": "MDKSA-2007:083",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:083"
        },
        {
          "name": "33723",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33723"
        },
        {
          "name": "25730",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25730"
        },
        {
          "name": "SUSE-SR:2007:008",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2007_8_sr.html"
        },
        {
          "name": "26290",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26290"
        },
        {
          "name": "modperl-pathinfo-dos(33312)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33312"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "name": "GLSA-200705-04",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200705-04.xml"
        },
        {
          "name": "23192",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/23192"
        },
        {
          "name": "20070602-01-P",
          "tags": [
            "vendor-advisory",
            "x_refsource_SGI"
          ],
          "url": "ftp://patches.sgi.com/support/free/security/advisories/20070602-01-P.asc"
        },
        {
          "name": "25072",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25072"
        },
        {
          "name": "oval:org.mitre.oval:def:10987",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10987"
        },
        {
          "name": "oval:org.mitre.oval:def:8349",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8349"
        },
        {
          "name": "25432",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25432"
        },
        {
          "name": "248386",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-248386-1"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-1349",
    "datePublished": "2007-03-30T00:00:00",
    "dateReserved": "2007-03-08T00:00:00",
    "dateUpdated": "2024-08-07T12:50:35.306Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2006-0898

Vulnerability from cvelistv5

Published

2006-02-25 11:00

Modified

2024-08-07 16:48

Severity ?

Summary

Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael.

References

▼	URL	Tags
	http://secunia.com/advisories/20899	third-party-advisory, x_refsource_SECUNIA
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://www.gentoo.org/security/en/glsa/glsa-200603-15.xml	vendor-advisory, x_refsource_GENTOO
	http://secunia.com/advisories/19187	third-party-advisory, x_refsource_SECUNIA
	http://securityreason.com/securityalert/488	third-party-advisory, x_refsource_SREASON
	http://www.debian.org/security/2006/dsa-996	vendor-advisory, x_refsource_DEBIAN
	http://www.securityfocus.com/archive/1/425966/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.novell.com/linux/security/advisories/2006_38_security.html	vendor-advisory, x_refsource_SUSE
	http://secunia.com/advisories/19303	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/18755	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/bid/16802	vdb-entry, x_refsource_BID
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	https://exchange.xforce.ibmcloud.com/vulnerabilities/24954	vdb-entry, x_refsource_XF

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:48:56.805Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20899",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/20899"
          },
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "name": "GLSA-200603-15",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://www.gentoo.org/security/en/glsa/glsa-200603-15.xml"
          },
          {
            "name": "19187",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19187"
          },
          {
            "name": "488",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/488"
          },
          {
            "name": "DSA-996",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2006/dsa-996"
          },
          {
            "name": "20060223 Vulnerability in Crypt::CBC Perl module, versions \u003c= 2.16",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/425966/100/0/threaded"
          },
          {
            "name": "SUSE-SR:2006:015",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2006_38_security.html"
          },
          {
            "name": "19303",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/19303"
          },
          {
            "name": "18755",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/18755"
          },
          {
            "name": "16802",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/16802"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "name": "crypt-cbc-header-weak-encryption(24954)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24954"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2006-02-23T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-18T14:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20899",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/20899"
        },
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "name": "GLSA-200603-15",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://www.gentoo.org/security/en/glsa/glsa-200603-15.xml"
        },
        {
          "name": "19187",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19187"
        },
        {
          "name": "488",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/488"
        },
        {
          "name": "DSA-996",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2006/dsa-996"
        },
        {
          "name": "20060223 Vulnerability in Crypt::CBC Perl module, versions \u003c= 2.16",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/425966/100/0/threaded"
        },
        {
          "name": "SUSE-SR:2006:015",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2006_38_security.html"
        },
        {
          "name": "19303",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/19303"
        },
        {
          "name": "18755",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/18755"
        },
        {
          "name": "16802",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/16802"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "name": "crypt-cbc-header-weak-encryption(24954)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24954"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2006-0898",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Crypt::CBC Perl module 2.16 and earlier, when running in RandomIV mode, uses an initialization vector (IV) of 8 bytes, which results in weaker encryption when used with a cipher that requires a larger block size than 8 bytes, such as Rijndael."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20899",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/20899"
            },
            {
              "name": "RHSA-2008:0630",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
            },
            {
              "name": "31493",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31493"
            },
            {
              "name": "GLSA-200603-15",
              "refsource": "GENTOO",
              "url": "http://www.gentoo.org/security/en/glsa/glsa-200603-15.xml"
            },
            {
              "name": "19187",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19187"
            },
            {
              "name": "488",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/488"
            },
            {
              "name": "DSA-996",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2006/dsa-996"
            },
            {
              "name": "20060223 Vulnerability in Crypt::CBC Perl module, versions \u003c= 2.16",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/425966/100/0/threaded"
            },
            {
              "name": "SUSE-SR:2006:015",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2006_38_security.html"
            },
            {
              "name": "19303",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/19303"
            },
            {
              "name": "18755",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/18755"
            },
            {
              "name": "16802",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/16802"
            },
            {
              "name": "RHSA-2008:0261",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
            },
            {
              "name": "crypt-cbc-header-weak-encryption(24954)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24954"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2006-0898",
    "datePublished": "2006-02-25T11:00:00",
    "dateReserved": "2006-02-25T00:00:00",
    "dateUpdated": "2024-08-07T16:48:56.805Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2007-1355

Vulnerability from cvelistv5

Published

2007-05-21 20:00

Modified

2024-08-07 12:50

Severity ?

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.

References

▼	URL	Tags
	http://tomcat.apache.org/security-4.html	x_refsource_CONFIRM
	http://secunia.com/advisories/30908	third-party-advisory, x_refsource_SECUNIA
	http://support.apple.com/kb/HT2163	x_refsource_CONFIRM
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1	vendor-advisory, x_refsource_SUNALERT
	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6111	vdb-entry, signature, x_refsource_OVAL
	http://www.vupen.com/english/advisories/2008/1981/references	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/30899	third-party-advisory, x_refsource_SECUNIA
	https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html	vendor-advisory, x_refsource_FEDORA
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://www.vupen.com/english/advisories/2008/1979/references	vdb-entry, x_refsource_VUPEN
	http://osvdb.org/34875	vdb-entry, x_refsource_OSVDB
	http://www.securityfocus.com/archive/1/500412/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/33668	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/archive/1/500396/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://securityreason.com/securityalert/2722	third-party-advisory, x_refsource_SREASON
	http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html	vendor-advisory, x_refsource_APPLE
	http://www.securityfocus.com/bid/24058	vdb-entry, x_refsource_BID
	http://www.vupen.com/english/advisories/2009/0233	vdb-entry, x_refsource_VUPEN
	http://tomcat.apache.org/security-6.html	x_refsource_CONFIRM
	http://www.vupen.com/english/advisories/2007/3386	vdb-entry, x_refsource_VUPEN
	http://secunia.com/advisories/30802	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/27037	third-party-advisory, x_refsource_SECUNIA
	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	vendor-advisory, x_refsource_HP
	http://secunia.com/advisories/27727	third-party-advisory, x_refsource_SECUNIA
	http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795	vendor-advisory, x_refsource_HP
	http://tomcat.apache.org/security-5.html	x_refsource_CONFIRM
	http://www.securityfocus.com/archive/1/469067/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	https://exchange.xforce.ibmcloud.com/vulnerabilities/34377	vdb-entry, x_refsource_XF
	http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx	x_refsource_CONFIRM
	http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T12:50:35.150Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-4.html"
          },
          {
            "name": "30908",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30908"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT2163"
          },
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "239312",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUNALERT",
              "x_transferred"
            ],
            "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1"
          },
          {
            "name": "oval:org.mitre.oval:def:6111",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6111"
          },
          {
            "name": "ADV-2008-1981",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1981/references"
          },
          {
            "name": "30899",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30899"
          },
          {
            "name": "FEDORA-2007-3456",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "name": "ADV-2008-1979",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/1979/references"
          },
          {
            "name": "34875",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/34875"
          },
          {
            "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
          },
          {
            "name": "33668",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33668"
          },
          {
            "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
          },
          {
            "name": "2722",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/2722"
          },
          {
            "name": "APPLE-SA-2008-06-30",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
          },
          {
            "name": "24058",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24058"
          },
          {
            "name": "ADV-2009-0233",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0233"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-6.html"
          },
          {
            "name": "ADV-2007-3386",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/3386"
          },
          {
            "name": "30802",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/30802"
          },
          {
            "name": "27037",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27037"
          },
          {
            "name": "SSRT071447",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
          },
          {
            "name": "27727",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27727"
          },
          {
            "name": "HPSBUX02262",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://tomcat.apache.org/security-5.html"
          },
          {
            "name": "20070519 [CVE-2007-1355] Tomcat documentation XSS vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/469067/100/0/threaded"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "name": "tomcat-hello-xss(34377)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34377"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-05-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:07:29",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-4.html"
        },
        {
          "name": "30908",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30908"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT2163"
        },
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "239312",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUNALERT"
          ],
          "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1"
        },
        {
          "name": "oval:org.mitre.oval:def:6111",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6111"
        },
        {
          "name": "ADV-2008-1981",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1981/references"
        },
        {
          "name": "30899",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30899"
        },
        {
          "name": "FEDORA-2007-3456",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "name": "ADV-2008-1979",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/1979/references"
        },
        {
          "name": "34875",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/34875"
        },
        {
          "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
        },
        {
          "name": "33668",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33668"
        },
        {
          "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
        },
        {
          "name": "2722",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/2722"
        },
        {
          "name": "APPLE-SA-2008-06-30",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
        },
        {
          "name": "24058",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24058"
        },
        {
          "name": "ADV-2009-0233",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0233"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-6.html"
        },
        {
          "name": "ADV-2007-3386",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/3386"
        },
        {
          "name": "30802",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/30802"
        },
        {
          "name": "27037",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27037"
        },
        {
          "name": "SSRT071447",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
        },
        {
          "name": "27727",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27727"
        },
        {
          "name": "HPSBUX02262",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://tomcat.apache.org/security-5.html"
        },
        {
          "name": "20070519 [CVE-2007-1355] Tomcat documentation XSS vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/469067/100/0/threaded"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "name": "tomcat-hello-xss(34377)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34377"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2007-1355",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://tomcat.apache.org/security-4.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-4.html"
            },
            {
              "name": "30908",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30908"
            },
            {
              "name": "http://support.apple.com/kb/HT2163",
              "refsource": "CONFIRM",
              "url": "http://support.apple.com/kb/HT2163"
            },
            {
              "name": "RHSA-2008:0630",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
            },
            {
              "name": "239312",
              "refsource": "SUNALERT",
              "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1"
            },
            {
              "name": "oval:org.mitre.oval:def:6111",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6111"
            },
            {
              "name": "ADV-2008-1981",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1981/references"
            },
            {
              "name": "30899",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30899"
            },
            {
              "name": "FEDORA-2007-3456",
              "refsource": "FEDORA",
              "url": "https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html"
            },
            {
              "name": "31493",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31493"
            },
            {
              "name": "ADV-2008-1979",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/1979/references"
            },
            {
              "name": "34875",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/34875"
            },
            {
              "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
            },
            {
              "name": "33668",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33668"
            },
            {
              "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
            },
            {
              "name": "2722",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/2722"
            },
            {
              "name": "APPLE-SA-2008-06-30",
              "refsource": "APPLE",
              "url": "http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html"
            },
            {
              "name": "24058",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24058"
            },
            {
              "name": "ADV-2009-0233",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0233"
            },
            {
              "name": "http://tomcat.apache.org/security-6.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-6.html"
            },
            {
              "name": "ADV-2007-3386",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/3386"
            },
            {
              "name": "30802",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/30802"
            },
            {
              "name": "27037",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27037"
            },
            {
              "name": "SSRT071447",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
            },
            {
              "name": "27727",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27727"
            },
            {
              "name": "HPSBUX02262",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795"
            },
            {
              "name": "http://tomcat.apache.org/security-5.html",
              "refsource": "CONFIRM",
              "url": "http://tomcat.apache.org/security-5.html"
            },
            {
              "name": "20070519 [CVE-2007-1355] Tomcat documentation XSS vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/469067/100/0/threaded"
            },
            {
              "name": "RHSA-2008:0261",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
            },
            {
              "name": "tomcat-hello-xss(34377)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/34377"
            },
            {
              "name": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx",
              "refsource": "CONFIRM",
              "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
            },
            {
              "name": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540",
              "refsource": "CONFIRM",
              "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
            },
            {
              "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2007-1355",
    "datePublished": "2007-05-21T20:00:00",
    "dateReserved": "2007-03-08T00:00:00",
    "dateUpdated": "2024-08-07T12:50:35.150Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2008-0128

Vulnerability from cvelistv5

Published

2008-01-23 01:00

Modified

2024-08-07 07:32

Severity ?

Summary

The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie.

References

▼	URL	Tags
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://www.securityfocus.com/bid/27365	vdb-entry, x_refsource_BID
	http://security-tracker.debian.net/tracker/CVE-2008-0128	x_refsource_CONFIRM
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/29242	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/archive/1/500412/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://issues.apache.org/bugzilla/show_bug.cgi?id=41217	x_refsource_CONFIRM
	http://secunia.com/advisories/33668	third-party-advisory, x_refsource_SECUNIA
	http://www.securityfocus.com/archive/1/500396/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://secunia.com/advisories/28549	third-party-advisory, x_refsource_SECUNIA
	https://exchange.xforce.ibmcloud.com/vulnerabilities/39804	vdb-entry, x_refsource_XF
	http://www.vupen.com/english/advisories/2008/0192	vdb-entry, x_refsource_VUPEN
	http://www.vupen.com/english/advisories/2009/0233	vdb-entry, x_refsource_VUPEN
	http://www.debian.org/security/2008/dsa-1468	vendor-advisory, x_refsource_DEBIAN
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	http://secunia.com/advisories/28552	third-party-advisory, x_refsource_SECUNIA
	http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx	x_refsource_CONFIRM
	http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540	x_refsource_CONFIRM
	https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST
	https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E	mailing-list, x_refsource_MLIST

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T07:32:23.929Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "27365",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/27365"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://security-tracker.debian.net/tracker/CVE-2008-0128"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "name": "29242",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/29242"
          },
          {
            "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
          },
          {
            "name": "SUSE-SR:2008:005",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://issues.apache.org/bugzilla/show_bug.cgi?id=41217"
          },
          {
            "name": "33668",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/33668"
          },
          {
            "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
          },
          {
            "name": "28549",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28549"
          },
          {
            "name": "apache-singlesignon-information-disclosure(39804)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39804"
          },
          {
            "name": "ADV-2008-0192",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/0192"
          },
          {
            "name": "ADV-2009-0233",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0233"
          },
          {
            "name": "DSA-1468",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2008/dsa-1468"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "name": "28552",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28552"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
          },
          {
            "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
          },
          {
            "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-01-21T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-02-13T16:07:50",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "27365",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/27365"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://security-tracker.debian.net/tracker/CVE-2008-0128"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "name": "29242",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/29242"
        },
        {
          "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
        },
        {
          "name": "SUSE-SR:2008:005",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://issues.apache.org/bugzilla/show_bug.cgi?id=41217"
        },
        {
          "name": "33668",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/33668"
        },
        {
          "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
        },
        {
          "name": "28549",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28549"
        },
        {
          "name": "apache-singlesignon-information-disclosure(39804)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39804"
        },
        {
          "name": "ADV-2008-0192",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/0192"
        },
        {
          "name": "ADV-2009-0233",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0233"
        },
        {
          "name": "DSA-1468",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2008/dsa-1468"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "name": "28552",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28552"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
        },
        {
          "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E"
        },
        {
          "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-0128",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The SingleSignOn Valve (org.apache.catalina.authenticator.SingleSignOn) in Apache Tomcat before 5.5.21 does not set the secure flag for the JSESSIONIDSSO cookie in an https session, which can cause the cookie to be sent in http requests and make it easier for remote attackers to capture this cookie."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2008:0630",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
            },
            {
              "name": "27365",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/27365"
            },
            {
              "name": "http://security-tracker.debian.net/tracker/CVE-2008-0128",
              "refsource": "CONFIRM",
              "url": "http://security-tracker.debian.net/tracker/CVE-2008-0128"
            },
            {
              "name": "31493",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31493"
            },
            {
              "name": "29242",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/29242"
            },
            {
              "name": "20090127 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities (Updated - v1.1)",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500412/100/0/threaded"
            },
            {
              "name": "SUSE-SR:2008:005",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00001.html"
            },
            {
              "name": "http://issues.apache.org/bugzilla/show_bug.cgi?id=41217",
              "refsource": "CONFIRM",
              "url": "http://issues.apache.org/bugzilla/show_bug.cgi?id=41217"
            },
            {
              "name": "33668",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/33668"
            },
            {
              "name": "20090124 CA20090123-01: Cohesion Tomcat Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/500396/100/0/threaded"
            },
            {
              "name": "28549",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/28549"
            },
            {
              "name": "apache-singlesignon-information-disclosure(39804)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39804"
            },
            {
              "name": "ADV-2008-0192",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/0192"
            },
            {
              "name": "ADV-2009-0233",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0233"
            },
            {
              "name": "DSA-1468",
              "refsource": "DEBIAN",
              "url": "http://www.debian.org/security/2008/dsa-1468"
            },
            {
              "name": "RHSA-2008:0261",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
            },
            {
              "name": "28552",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/28552"
            },
            {
              "name": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx",
              "refsource": "CONFIRM",
              "url": "http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx"
            },
            {
              "name": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540",
              "refsource": "CONFIRM",
              "url": "http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540"
            },
            {
              "name": "[tomcat-dev] 20190319 svn commit: r1855831 [21/30] - in /tomcat/site/trunk: ./ docs/ xdocs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20190325 svn commit: r1856174 [19/29] - in /tomcat/site/trunk: docs/ xdocs/ xdocs/stylesheets/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74@%3Cdev.tomcat.apache.org%3E"
            },
            {
              "name": "[tomcat-dev] 20200213 svn commit: r1873980 [24/34] - /tomcat/site/trunk/docs/",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3@%3Cdev.tomcat.apache.org%3E"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-0128",
    "datePublished": "2008-01-23T01:00:00",
    "dateReserved": "2008-01-07T00:00:00",
    "dateUpdated": "2024-08-07T07:32:23.929Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2007-6306

Vulnerability from cvelistv5

Published

2007-12-11 21:00

Modified

2024-08-07 16:02

Severity ?

Summary

Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area.

References

▼	URL	Tags
	http://rhn.redhat.com/errata/RHSA-2008-0630.html	vendor-advisory, x_refsource_REDHAT
	http://www.redhat.com/support/errata/RHSA-2008-0213.html	vendor-advisory, x_refsource_REDHAT
	http://www.rapid7.com/advisories/R7-0031.jsp	x_refsource_MISC
	http://secunia.com/advisories/31493	third-party-advisory, x_refsource_SECUNIA
	http://secunia.com/advisories/27959	third-party-advisory, x_refsource_SECUNIA
	http://www.redhat.com/support/errata/RHSA-2008-0151.html	vendor-advisory, x_refsource_REDHAT
	http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/branches/jfreechart-1.0.8-security/NEWS?r1=679&r2=680	x_refsource_CONFIRM
	http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/entity/ChartEntity.java?r1=662&r2=661&pathrev=662	x_refsource_MISC
	http://www.securityfocus.com/bid/26752	vdb-entry, x_refsource_BID
	http://www.securityfocus.com/archive/1/484709/100/0/threaded	mailing-list, x_refsource_BUGTRAQ
	http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/imagemap/ImageMapUtilities.java?r1=662&r2=661&pathrev=662	x_refsource_MISC
	http://osvdb.org/41843	vdb-entry, x_refsource_OSVDB
	http://osvdb.org/41844	vdb-entry, x_refsource_OSVDB
	http://securityreason.com/securityalert/3430	third-party-advisory, x_refsource_SREASON
	http://osvdb.org/41845	vdb-entry, x_refsource_OSVDB
	http://www.redhat.com/support/errata/RHSA-2008-0158.html	vendor-advisory, x_refsource_REDHAT
	http://www.redhat.com/support/errata/RHSA-2008-0261.html	vendor-advisory, x_refsource_REDHAT
	https://exchange.xforce.ibmcloud.com/vulnerabilities/38922	vdb-entry, x_refsource_XF

Impacted products

▼	Vendor	Product
	n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T16:02:36.495Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2008:0630",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
          },
          {
            "name": "RHSA-2008:0213",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0213.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.rapid7.com/advisories/R7-0031.jsp"
          },
          {
            "name": "31493",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31493"
          },
          {
            "name": "27959",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/27959"
          },
          {
            "name": "RHSA-2008:0151",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0151.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/branches/jfreechart-1.0.8-security/NEWS?r1=679\u0026r2=680"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/entity/ChartEntity.java?r1=662\u0026r2=661\u0026pathrev=662"
          },
          {
            "name": "26752",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/26752"
          },
          {
            "name": "20071206 R7-0031: JFreeChart Image Map Cross-Site Scripting Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/484709/100/0/threaded"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/imagemap/ImageMapUtilities.java?r1=662\u0026r2=661\u0026pathrev=662"
          },
          {
            "name": "41843",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/41843"
          },
          {
            "name": "41844",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/41844"
          },
          {
            "name": "3430",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/3430"
          },
          {
            "name": "41845",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/41845"
          },
          {
            "name": "RHSA-2008:0158",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0158.html"
          },
          {
            "name": "RHSA-2008:0261",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
          },
          {
            "name": "jfreechart-imagemap-xss(38922)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38922"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-12-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-15T20:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "RHSA-2008:0630",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
        },
        {
          "name": "RHSA-2008:0213",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0213.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.rapid7.com/advisories/R7-0031.jsp"
        },
        {
          "name": "31493",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31493"
        },
        {
          "name": "27959",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/27959"
        },
        {
          "name": "RHSA-2008:0151",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0151.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/branches/jfreechart-1.0.8-security/NEWS?r1=679\u0026r2=680"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/entity/ChartEntity.java?r1=662\u0026r2=661\u0026pathrev=662"
        },
        {
          "name": "26752",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/26752"
        },
        {
          "name": "20071206 R7-0031: JFreeChart Image Map Cross-Site Scripting Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/484709/100/0/threaded"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/imagemap/ImageMapUtilities.java?r1=662\u0026r2=661\u0026pathrev=662"
        },
        {
          "name": "41843",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/41843"
        },
        {
          "name": "41844",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/41844"
        },
        {
          "name": "3430",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/3430"
        },
        {
          "name": "41845",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/41845"
        },
        {
          "name": "RHSA-2008:0158",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0158.html"
        },
        {
          "name": "RHSA-2008:0261",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
        },
        {
          "name": "jfreechart-imagemap-xss(38922)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38922"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-6306",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple cross-site scripting (XSS) vulnerabilities in the image map feature in JFreeChart 1.0.8 allow remote attackers to inject arbitrary web script or HTML via the (1) chart name or (2) chart tool tip text; or the (3) href, (4) shape, or (5) coords attribute of a chart area."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2008:0630",
              "refsource": "REDHAT",
              "url": "http://rhn.redhat.com/errata/RHSA-2008-0630.html"
            },
            {
              "name": "RHSA-2008:0213",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0213.html"
            },
            {
              "name": "http://www.rapid7.com/advisories/R7-0031.jsp",
              "refsource": "MISC",
              "url": "http://www.rapid7.com/advisories/R7-0031.jsp"
            },
            {
              "name": "31493",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31493"
            },
            {
              "name": "27959",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/27959"
            },
            {
              "name": "RHSA-2008:0151",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0151.html"
            },
            {
              "name": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/branches/jfreechart-1.0.8-security/NEWS?r1=679\u0026r2=680",
              "refsource": "CONFIRM",
              "url": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/branches/jfreechart-1.0.8-security/NEWS?r1=679\u0026r2=680"
            },
            {
              "name": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/entity/ChartEntity.java?r1=662\u0026r2=661\u0026pathrev=662",
              "refsource": "MISC",
              "url": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/entity/ChartEntity.java?r1=662\u0026r2=661\u0026pathrev=662"
            },
            {
              "name": "26752",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/26752"
            },
            {
              "name": "20071206 R7-0031: JFreeChart Image Map Cross-Site Scripting Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/484709/100/0/threaded"
            },
            {
              "name": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/imagemap/ImageMapUtilities.java?r1=662\u0026r2=661\u0026pathrev=662",
              "refsource": "MISC",
              "url": "http://jfreechart.svn.sourceforge.net/viewvc/jfreechart/trunk/source/org/jfree/chart/imagemap/ImageMapUtilities.java?r1=662\u0026r2=661\u0026pathrev=662"
            },
            {
              "name": "41843",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/41843"
            },
            {
              "name": "41844",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/41844"
            },
            {
              "name": "3430",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/3430"
            },
            {
              "name": "41845",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/41845"
            },
            {
              "name": "RHSA-2008:0158",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0158.html"
            },
            {
              "name": "RHSA-2008:0261",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2008-0261.html"
            },
            {
              "name": "jfreechart-imagemap-xss(38922)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38922"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-6306",
    "datePublished": "2007-12-11T21:00:00",
    "dateReserved": "2007-12-11T00:00:00",
    "dateUpdated": "2024-08-07T16:02:36.495Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_redhat

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature