Apache Software Foundation Tomcat 4.1.32
Approved changes feed: RSS · Atom
cpe:2.3:a:apache:tomcat:4.1.32:*:*:*:*:*:*:*
part: a version: 4.1.32 update: *
| Vendor | Apache (b0303047-b7dd-5cf8-abcc-71b7d9d80b95) |
|---|---|
| Product | Tomcat (caaa56d3-0cc4-5735-aab9-a3a1a7f4dc56) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:apache/tomcat |
purl2cpe | 2026-06-01 10:14:27.036748 |
pkg:github/apache/tomcat |
purl2cpe | 2026-06-01 10:14:27.036749 |
pkg:maven/org.apache.tomcat/tomcat |
purl2cpe | 2026-06-01 10:14:27.036750 |
pkg:rpm/fedora/tomcat |
purl2cpe | 2026-06-01 10:14:27.036751 |
pkg:rpm/opensuse/tomcat |
purl2cpe | 2026-06-01 10:14:27.036753 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2009-3548 |
vulnerable | 2026-06-08 04:51:42.522208 |
Details available
The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.
Published: 2009-11-12T23:00:00.000Z
Updated: 2024-08-07T06:31:10.462Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-0781 |
vulnerable | 2026-06-08 04:51:11.309105 |
Details available
Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML."
Published: 2009-03-09T21:00:00.000Z
Updated: 2024-08-07T04:48:52.130Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-0580 |
vulnerable | 2026-06-08 04:51:10.142818 |
Details available
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.
Published: 2009-06-05T15:25:00.000Z
Updated: 2024-08-07T04:40:04.335Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2009-0033 |
vulnerable | 2026-06-08 04:51:07.115477 |
Details available
Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header.
Published: 2009-06-05T15:25:00.000Z
Updated: 2024-08-07T04:17:10.437Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-5519 |
vulnerable | 2026-06-08 04:50:51.835446 |
Details available
The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers.
Published: 2009-04-09T15:00:00.000Z
Updated: 2024-08-07T10:56:46.621Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-5515 |
vulnerable | 2026-06-08 04:50:51.699975 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-4308 |
vulnerable | 2026-06-08 04:50:38.569707 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2008-2370 |
vulnerable | 2026-06-08 04:50:23.697357 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2007-5461 |
vulnerable | 2026-06-08 04:50:06.096905 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2005-4836 |
vulnerable | 2026-06-08 04:48:45.325738 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.