CVE-2007-2450

Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.

• CWE-79

• http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
• http://jvn.jp/jp/JVN%2307100457/index.html
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
• http://secunia.com/advisories/25678Vendor Advisory
• http://secunia.com/advisories/26076Vendor Advisory
• http://secunia.com/advisories/27037Vendor Advisory
• http://secunia.com/advisories/27727Vendor Advisory
• http://secunia.com/advisories/28549Vendor Advisory
• http://secunia.com/advisories/30802Vendor Advisory
• http://secunia.com/advisories/30899Vendor Advisory
• http://secunia.com/advisories/30908Vendor Advisory
• http://secunia.com/advisories/33668Vendor Advisory
• http://securityreason.com/securityalert/2813
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1
• http://support.apple.com/kb/HT2163
• http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
• http://tomcat.apache.org/security-4.htmlPatch, Vendor Advisory
• http://tomcat.apache.org/security-5.htmlPatch, Vendor Advisory
• http://tomcat.apache.org/security-6.htmlPatch, Vendor Advisory
• http://www.debian.org/security/2008/dsa-1468
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:241
• http://www.osvdb.org/36079
• http://www.redhat.com/support/errata/RHSA-2007-0569.html
• http://www.redhat.com/support/errata/RHSA-2008-0261.html
• http://www.securityfocus.com/archive/1/471357/100/0/threaded
• http://www.securityfocus.com/archive/1/500396/100/0/threaded
• http://www.securityfocus.com/archive/1/500412/100/0/threaded
• http://www.securityfocus.com/bid/24475
• http://www.securitytracker.com/id?1018245
• http://www.vupen.com/english/advisories/2007/2213
• http://www.vupen.com/english/advisories/2007/3386
• http://www.vupen.com/english/advisories/2008/1979/references
• http://www.vupen.com/english/advisories/2008/1981/references
• http://www.vupen.com/english/advisories/2009/0233
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34868
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11287
• https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html
• http://community.ca.com/blogs/casecurityresponseblog/archive/2009/01/23.aspx
• http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01178795
• http://jvn.jp/jp/JVN%2307100457/index.html
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
• http://secunia.com/advisories/25678Vendor Advisory
• http://secunia.com/advisories/26076Vendor Advisory
• http://secunia.com/advisories/27037Vendor Advisory
• http://secunia.com/advisories/27727Vendor Advisory
• http://secunia.com/advisories/28549Vendor Advisory
• http://secunia.com/advisories/30802Vendor Advisory
• http://secunia.com/advisories/30899Vendor Advisory
• http://secunia.com/advisories/30908Vendor Advisory
• http://secunia.com/advisories/33668Vendor Advisory
• http://securityreason.com/securityalert/2813
• http://sunsolve.sun.com/search/document.do?assetkey=1-26-239312-1
• http://support.apple.com/kb/HT2163
• http://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=197540
• http://tomcat.apache.org/security-4.htmlPatch, Vendor Advisory
• http://tomcat.apache.org/security-5.htmlPatch, Vendor Advisory
• http://tomcat.apache.org/security-6.htmlPatch, Vendor Advisory
• http://www.debian.org/security/2008/dsa-1468
• http://www.mandriva.com/security/advisories?name=MDKSA-2007:241
• http://www.osvdb.org/36079
• http://www.redhat.com/support/errata/RHSA-2007-0569.html
• http://www.redhat.com/support/errata/RHSA-2008-0261.html
• http://www.securityfocus.com/archive/1/471357/100/0/threaded
• http://www.securityfocus.com/archive/1/500396/100/0/threaded
• http://www.securityfocus.com/archive/1/500412/100/0/threaded
• http://www.securityfocus.com/bid/24475
• http://www.securitytracker.com/id?1018245
• http://www.vupen.com/english/advisories/2007/2213
• http://www.vupen.com/english/advisories/2007/3386
• http://www.vupen.com/english/advisories/2008/1979/references
• http://www.vupen.com/english/advisories/2008/1981/references
• http://www.vupen.com/english/advisories/2009/0233
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34868
• https://lists.apache.org/thread.html/29dc6c2b625789e70a9c4756b5a327e6547273ff8bde7e0327af48c5%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/c62b0e3a7bf23342352a5810c640a94b6db69957c5c19db507004d74%40%3Cdev.tomcat.apache.org%3E
• https://lists.apache.org/thread.html/rb71997f506c6cc8b530dd845c084995a9878098846c7b4eacfae8db3%40%3Cdev.tomcat.apache.org%3E
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11287
• https://www.redhat.com/archives/fedora-package-announce/2007-November/msg00525.html

Published

Jun 14, 2007

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2007-2444Logic error in the SID/Name translation functionality in smb…
• CVE-2007-2445The png_handle_tRNS function in pngrutil.c in libpng before …
• CVE-2007-2446Multiple heap-based buffer overflows in the NDR parsing in s…
• CVE-2007-2447The MS-RPC functionality in smbd in Samba 3.0.0 through 3.0.…
• CVE-2007-2448Subversion 1.4.3 and earlier does not properly implement the…
• CVE-2007-2449Multiple cross-site scripting (XSS) vulnerabilities in certa…
• CVE-2007-2451Unspecified vulnerability in drivers/crypto/geode-aes.c in G…
• CVE-2007-2452Heap-based buffer overflow in the visit_old_format function …
• CVE-2007-2453The random number feature in Linux kernel 2.6 before 2.6.20.…
• CVE-2007-2454Heap-based buffer overflow in the VGA device in Parallels al…
• CVE-2007-2455Parallels allows local users to cause a denial of service (v…
• CVE-2007-2456Multiple PHP remote file inclusion vulnerabilities in FireFl…