GCVE - cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:tomcat:4.1.35:*:*:*:*:*:*:*

part: a version: 4.1.35 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Tomcat (`caaa56d3-0cc4-5735-aab9-a3a1a7f4dc56`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/tomcat`	purl2cpe	2026-06-01 10:14:27.041613
`pkg:github/apache/tomcat`	purl2cpe	2026-06-01 10:14:27.041615
`pkg:maven/org.apache.tomcat/tomcat`	purl2cpe	2026-06-01 10:14:27.041616
`pkg:rpm/fedora/tomcat`	purl2cpe	2026-06-01 10:14:27.041618
`pkg:rpm/opensuse/tomcat`	purl2cpe	2026-06-01 10:14:27.041619

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-3548`	vulnerable	2026-06-08 04:51:42.523670	Details available The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges. Published: 2009-11-12T23:00:00.000Z Updated: 2024-08-07T06:31:10.462Z Open on db.gcve.eu Reference links http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02241113 http://marc.info/?l=bugtraq&m=127420533226623&w=2 http://marc.info/?l=bugtraq&m=136485229118404&w=2 http://secunia.com/advisories/40330 http://marc.info/?l=bugtraq&m=127420533226623&w=2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0781`	vulnerable	2026-06-08 04:51:11.309163	Details available Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote attackers to inject arbitrary web script or HTML via the time parameter, related to "invalid HTML." Published: 2009-03-09T21:00:00.000Z Updated: 2024-08-07T04:48:52.130Z Open on db.gcve.eu Reference links http://tomcat.apache.org/security-4.html http://marc.info/?l=bugtraq&m=127420533226623&w=2 http://www.mandriva.com/security/advisories?name=MDVSA-2009:138 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6564 https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0580`	vulnerable	2026-06-08 04:51:10.142877	Details available Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter. Published: 2009-06-05T15:25:00.000Z Updated: 2024-08-07T04:40:04.335Z Open on db.gcve.eu Reference links https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9101 http://tomcat.apache.org/security-4.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18915 http://marc.info/?l=bugtraq&m=127420533226623&w=2 http://secunia.com/advisories/35326	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2009-0033`	vulnerable	2026-06-08 04:51:07.116925	Details available Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage) via a crafted request with invalid headers, related to temporary blocking of connectors that have encountered errors, as demonstrated by an error involving a malformed HTTP Host header. Published: 2009-06-05T15:25:00.000Z Updated: 2024-08-07T04:17:10.437Z Open on db.gcve.eu Reference links http://tomcat.apache.org/security-4.html http://marc.info/?l=bugtraq&m=127420533226623&w=2 http://secunia.com/advisories/35326 http://www.mandriva.com/security/advisories?name=MDVSA-2009:138 https://www.redhat.com/archives/fedora-package-announce/2009-November/msg01246.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-5519`	vulnerable	2026-06-08 04:50:51.835504	Details available The JK Connector (aka mod_jk) 1.2.0 through 1.2.26 in Apache Tomcat allows remote attackers to obtain sensitive information via an arbitrary request from an HTTP client, in opportunistic circumstances involving (1) a request from a different client that included a Content-Length header but no POST data or (2) a rapid series of requests, related to noncompliance with the AJP protocol's requirements for requests containing Content-Length headers. Published: 2009-04-09T15:00:00.000Z Updated: 2024-08-07T10:56:46.621Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2009/0973 http://tomcat.apache.org/connectors-doc/miscellaneous/changelog.html http://secunia.com/advisories/34621 http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html http://securitytracker.com/id?1022001	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-5515`	vulnerable	2026-06-08 04:50:51.701504	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-2370`	vulnerable	2026-06-08 04:50:23.698736	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2007-5461`	vulnerable	2026-06-08 04:50:06.099028	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4836`	vulnerable	2026-06-08 04:48:45.327830	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.