This alert was generated using only banner information. It may be a false positive.
Fixed in Apache Tomcat 5.5.26:
low: Session hi-jacking CVE-2007-5333
The previous fix for CVE-2007-3385 was incomplete. It did not consider the use of quotes or %5C within a cookie value.
low: Elevated privileges CVE-2007-5342
The JULI logging component allows web applications to provide their own logging configurations. The default security policy does not restrict this configuration and allows an untrusted web application to add files or overwrite existing files where the Tomcat process has the necessary file permissions to do so.
important: Information disclosure CVE-2007-5461
When Tomcat's WebDAV servlet is configured for use with a context and has been enabled for write, some WebDAV requests that specify an entity with a SYSTEM tag can result in the contents of arbitary files being returned to the client.
important: Data integrity CVE-2007-6286
When using the native (APR based) connector, connecting to the SSL port using netcat and then disconnecting without sending any data will cause tomcat to handle a duplicate copy of one of the recent requests.
Affected Apache Tomcat version (5.5.0 - 5.5.25).
- low: Session hi-jacking CVE-2007-5333
- Upgrade Apache Tomcat to the latest version.
- WordPress Plugin WP All Backup Unspecified Vulnerability (1.5)
- WordPress Plugin Verification Code for Comments Multiple Cross-Site Scripting Vulnerabilities (2.1.0)
- WordPress Plugin Tera Charts Multiple Local File Inclusion Vulnerabilities (0.1)
- WordPress Plugin Bookly #1 WordPress Booking Plugin (Lite Version) Cross-Site Scripting (14.4)
- WordPress Plugin Sendit Newsletter 'id' Parameter SQL Injection (2.1.0)