GCVE - cpe:2.3:a:apache:tomcat:5.5.34:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apache:tomcat:5.5.34:*:*:*:*:*:*:*

part: a version: 5.5.34 update: *

Vendor	Apache (`b0303047-b7dd-5cf8-abcc-71b7d9d80b95`)
Product	Tomcat (`caaa56d3-0cc4-5735-aab9-a3a1a7f4dc56`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:apache/tomcat`	purl2cpe	2026-06-01 10:14:27.060455
`pkg:github/apache/tomcat`	purl2cpe	2026-06-01 10:14:27.060456
`pkg:maven/org.apache.tomcat/tomcat`	purl2cpe	2026-06-01 10:14:27.060457
`pkg:rpm/fedora/tomcat`	purl2cpe	2026-06-01 10:14:27.060459
`pkg:rpm/opensuse/tomcat`	purl2cpe	2026-06-01 10:14:27.060460

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2013-4590`	vulnerable	2026-06-08 05:04:48.568811	Details available Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 allows attackers to obtain "Tomcat internals" information by leveraging the presence of an untrusted web application with a context.xml, web.xml, .jspx, .tagx, or *.tld XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. Published: 2014-02-26T11:00:00.000Z Updated: 2024-08-06T16:45:15.235Z Open on db.gcve.eu Reference links http://www.vmware.com/security/advisories/VMSA-2014-0008.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:052 http://secunia.com/advisories/59724 http://www.mandriva.com/security/advisories?name=MDVSA-2015:084 http://www.debian.org/security/2016/dsa-3530	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4322`	vulnerable	2026-06-08 05:04:35.494601	Details available Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544. Published: 2014-02-26T11:00:00.000Z Updated: 2024-08-06T16:38:01.901Z Open on db.gcve.eu Reference links http://www.vmware.com/security/advisories/VMSA-2014-0008.html http://svn.apache.org/viewvc?view=revision&revision=1549522 http://www.vmware.com/security/advisories/VMSA-2014-0012.html https://rhn.redhat.com/errata/RHSA-2014-0686.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:052	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-4286`	vulnerable	2026-06-08 05:04:35.206726	Details available Apache Tomcat before 6.0.39, 7.x before 7.0.47, and 8.x before 8.0.0-RC3, when an HTTP connector or AJP connector is used, does not properly handle certain inconsistent HTTP request headers, which allows remote attackers to trigger incorrect identification of a request's length and conduct request-smuggling attacks via (1) multiple Content-Length headers or (2) a Content-Length header and a "Transfer-Encoding: chunked" header. NOTE: this vulnerability exists because of an incomplete fix for CVE-2005-2090. Published: 2014-02-26T11:00:00.000Z Updated: 2024-08-06T16:38:01.900Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2014-0345.html http://secunia.com/advisories/59733 http://www.vmware.com/security/advisories/VMSA-2014-0012.html https://rhn.redhat.com/errata/RHSA-2014-0686.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:052	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5887`	vulnerable	2026-06-08 05:02:58.577062	Details available The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests. Published: 2012-11-17T19:00:00.000Z Updated: 2024-08-06T21:21:27.681Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=swg21626891 http://secunia.com/advisories/51371 http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html http://svn.apache.org/viewvc?view=revision&revision=1392248 http://rhn.redhat.com/errata/RHSA-2013-0631.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5886`	vulnerable	2026-06-08 05:02:58.574391	Details available The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID. Published: 2012-11-17T19:00:00.000Z Updated: 2024-08-06T21:21:27.875Z Open on db.gcve.eu Reference links http://www-01.ibm.com/support/docview.wss?uid=swg21626891 http://secunia.com/advisories/51371 http://lists.opensuse.org/opensuse-updates/2012-12/msg00089.html http://svn.apache.org/viewvc?view=revision&revision=1392248 http://rhn.redhat.com/errata/RHSA-2013-0631.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5885`	vulnerable	2026-06-08 05:02:58.563318	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0022`	vulnerable	2026-06-08 04:59:35.594092	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.