The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apache Tomcat | — | Upgrade Apache Tomcat to 6.0.6Upgrade Apache Tomcat to the latest available versionUpgrade Apache Tomcat to 4.1.36Upgrade Apache Tomcat to 5.5.21Upgrade Apache Tomcat to 5.0.0 | May 17, 2012 | May 9, 2007 |
| Apple Osx Tomcat | — | Apply OS X security update 2007-007 | Dec 16, 2011 | May 9, 2007 |
| Freebsd | — | Upgrade tomcatUpgrade apache-tomcatUpgrade jakarta-tomcat | Dec 10, 2025 | Jul 24, 2007 |
| Oracle_linux | — | Upgrade tomcat5-common-libUpgrade tomcat5-jsp-2.0-api-javadocUpgrade jakarta-commons-modeler-javadocUpgrade tomcat5Upgrade tomcat5-jsp-2.0-apiUpgrade tomcat5-servlet-2.4-api-javadocUpgrade tomcat5-servlet-2.4-apiUpgrade jakarta-commons-modelerUpgrade tomcat5-jasperUpgrade tomcat5-server-libUpgrade tomcat5-admin-webappsUpgrade tomcat5-jasper-javadocUpgrade tomcat5-webapps | Oct 16, 2024 | May 9, 2007 |
| Suse | — | Upgrade apache2-jakarta-tomcat-connectorsUpgrade apache-jakarta-tomcat-connectorsUpgrade jakarta-tomcat-docUpgrade jakarta-tomcat-examplesUpgrade tomcat5-admin-webappsUpgrade jakarta-tomcatUpgrade tomcat5-webappsUpgrade tomcat5 | Dec 12, 2013 | May 9, 2007 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub