The version of Apache Tomcat installed on the remote host is < 8.5.84. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.84_security-8 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 9.0.69. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.69_security-9 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.1.2. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.1.2_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 8.5.78. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.78_security-8 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 9.0.62. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.62_security-9 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 9.0.65. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.65_security-9 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 8.5.82. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.82_security-8 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.1.0-M17. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.1.0-m17_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.23. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.23_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 9.0.63. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.63_security-9 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 8.5.79. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.79_security-8 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.1.0-M15. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.1.0-m15_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.21. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.21_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 8.5.75. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_8.5.75_security-8 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.1.0-M10. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.1.0-m10_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.16. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.0.16_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 9.0.58. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_9.0.58_security-9 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.1.0-M6. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.1.0-m6_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 9.0.54. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.54_security-9 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.12. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.12_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 8.5.72. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.72_security-8 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 8.5.64. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.64_security-8 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 9.0.44. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.44_security-9 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.4. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.4_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 9.0.46. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.46_security-9 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.7. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.7_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 8.5.68. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.68_security-8 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 9.0.48. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.48_security-9 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 8.5.66. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_8.5.66_security-8 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.6. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.6_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.0-M5. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.0-m5_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.2. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.0.2_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 7.0.84. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.84_security-7 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 7.0.88. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.88_security-7 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 7.0.67. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.67_security-7 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 7.0.65. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.65_security-7 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 7.0.91. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.91_security-7 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 7.0.78. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_7.0.78_security-7 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.0-M8. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.0-m8_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.0-M6. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_10.0.0-m6_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.0-M10. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.0.0-m10_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is < 10.0.0-M7. It is, therefore, affected by multiple vulnerabilities as referenced in the fixed_in_apache_tomcat_10.0.0-m7_security-10 advisory. Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The Apache Tomcat installed on the remote host version 7.0.x prior to 7.0.100, 8.5.x prior to 8.5.51, or 9.0.x prior to 9.0.31 is affected by an arbitrary file read vulnerability in its AJP protocol due to an implementation defect. A remote, unauthenticated attacker could exploit this to access files which, under normal conditions, would be restricted. If the Tomcat instance supports file uploads, the vulnerability could also be leveraged to achieve remote code execution.

According to its banner, the version of PHP running on the remote web server is prior to 7.1.33, 7.2.x prior to 7.2.24, or 7.3.x prior to 7.3.11. It is, therefore, affected by a remote code execution vulnerability due to insufficient validation of user input. An unauthenticated, remote attacker can exploit this, by sending a specially crafted request, to cause the execution of arbitrary code by breaking the fastcgi_split_path_info directive.

The remote web server is running a version of nginx that is affected by the following vulnerabilities:

 - A vulnerability exists that involves window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. An attacker can manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both. (CVE-2019-9511)
 - The affected versions of nginx are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU. (CVE-2019-9513)
 - The affected versions of nginx vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory. (CVE-2019-9516)

The version of Tomcat installed on the remote Windows host is prior to 9.0.19. It is, therefore, affected by a remote code execution vulnerability due to a bug in the way the JRE passes command line arguments to Windows. An unauthenticated, remote attacker can exploit this to execute arbitrary commands. Additionally, it is affected by a cross-site (XSS) scripting vulnerability as the SSI printenv command echoes user provided data without proper escaping.

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tomcat installed on the remote host is prior to 9.0.16. It is, therefore, affected by a vulnerability as referenced in the fixed_in_apache_tomcat_9.0.16_security-9 advisory.

 - The HTTP/2 implementation accepted streams with excessive numbers of SETTINGS frames and also permitted clients to keep streams open without reading/writing request/response data. By keeping streams open for requests that utilised the Servlet API's blocking I/O, clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS. (CVE-2019-0199)

Note that Nessus Network Monitor has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apache Tomcat installed on the remote host is version 9.0.x prior to 9.0.12. It is, therefore, affected by an open redirect vulnerability. When the default servlet returned a redirect to a directory (e.g. redirecting to /foo/ when the user requested /foo) a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.10. It is, therefore, affected by multiple vulnerabilities.

 - A security misconfiguration vulnerability exists in Apache Tomcat prior to version 9.0.9 due to insecure default settings for the CORS filter (CVE-2018-8014).

 - A security misconfiguration vulnerability exists in Apache Tomcat prior to version 9.0.10. Hostname validation was not enabled by default when using TLS with the WebSocket client (CVE-2018-8034).

 - An information disclosure vulnerability exists in Apache Tomcat prior to version 9.0.10 due to a race condition. If an async request was completed by the application at the same time as the container triggered the async timeout, this could lead to a user being sent the response of another user. (CVE-2018-8037)

The version of Apache Tomcat installed on the remote host is 9.0.x prior to 9.0.10. It is, therefore, affected by multiple vulnerabilities:

 - A security misconfiguration vulnerability exists in Apache Tomcat prior to version 9.0.9 due to insecure default settings for the CORS filter (CVE-2018-8014).

 - A security misconfiguration vulnerability exists in Apache Tomcat prior to version 9.0.10. Hostname validation was not enabled by default when using TLS with the WebSocket client (CVE-2018-8034).

 - An information disclosure vulnerability exists in Apache Tomcat prior to version 9.0.10 due to a race condition. If an async request was completed by the application at the same time as the container triggered the async timeout, this could lead to a user being sent the response of another user. (CVE-2018-8037).

ID	Name	Severity
701434	Apache Tomcat < 8.5.84 Vulnerability	medium
701433	Apache Tomcat < 9.0.69 Vulnerability	medium
701432	Apache Tomcat < 10.1.2 Vulnerability	medium
701425	Apache Tomcat < 8.5.78 Vulnerability	medium
701424	Apache Tomcat < 9.0.62 Vulnerability	medium
701413	Apache Tomcat < 9.0.65 Vulnerability	low
701412	Apache Tomcat < 8.5.82 Vulnerability	medium
701411	Apache Tomcat < 10.1.0-M17 Vulnerability	medium
701410	Apache Tomcat < 10.0.23 Vulnerability	medium
701405	Apache Tomcat < 9.0.63 Vulnerability	high
701404	Apache Tomcat < 8.5.79 Vulnerability	high
701403	Apache Tomcat < 10.1.0-M15 Vulnerability	high
701402	Apache Tomcat < 10.0.21 Vulnerability	high
701388	Apache Tomcat < 8.5.75 Multiple Vulnerabilities	medium
701387	Apache Tomcat < 10.1.0-M10 Multiple Vulnerabilities	medium
701386	Apache Tomcat < 10.0.16 Multiple Vulnerabilities	medium
701385	Apache Tomcat < 9.0.58 Multiple Vulnerabilities	medium
701374	Apache Tomcat < 10.1.0-M6 Vulnerability	medium
701373	Apache Tomcat < 9.0.54 Vulnerability	medium
701372	Apache Tomcat < 10.0.12 Vulnerability	medium
701371	Apache Tomcat < 8.5.72 Vulnerability	medium
701366	Apache Tomcat < 8.5.64 Vulnerability	medium
701365	Apache Tomcat < 9.0.44 Vulnerability	medium
701364	Apache Tomcat < 10.0.4 Vulnerability	medium
701357	Apache Tomcat < 9.0.46 Vulnerability	medium
701356	Apache Tomcat < 10.0.7 Vulnerability	medium
701355	Apache Tomcat < 8.5.68 Vulnerability	medium
701354	Apache Tomcat < 9.0.48 Vulnerability	medium
701353	Apache Tomcat < 8.5.66 Vulnerability	medium
701352	Apache Tomcat < 10.0.6 Vulnerability	medium
701351	Apache Tomcat < 10.0.0-M5 Vulnerability	medium
701350	Apache Tomcat < 10.0.2 Multiple Vulnerabilities	medium
701338	Apache Tomcat < 7.0.84 Vulnerability	medium
701337	Apache Tomcat < 7.0.88 Vulnerability	medium
701336	Apache Tomcat < 7.0.67 Vulnerability	medium
701335	Apache Tomcat < 7.0.65 Vulnerability	medium
701334	Apache Tomcat < 7.0.91 Vulnerability	medium
701333	Apache Tomcat < 7.0.78 Vulnerability	medium
701332	Apache Tomcat < 10.0.0-M8 Vulnerability	medium
701331	Apache Tomcat < 10.0.0-M6 Vulnerability	medium
701330	Apache Tomcat < 10.0.0-M10 Multiple Vulnerabilities	medium
701329	Apache Tomcat < 10.0.0-M7 Multiple Vulnerabilities	high
701269	Apache Tomcat 7.0.x < 7.0.100 / 8.5.x < 8.5.51 / 9.0.x < 9.0.31 Arbitrary File Read Vulnerability	high
701235	PHP < 7.1.33 / 7.2.x < 7.2.24 / 7.3.x < 7.3.11 Remote Code Execution	high
701146	nginx < 1.16.1 (stable) / 1.17.3 (mainline) Multiple DoS	high
700711	Apache Tomcat 9.0.x < 9.0.19 Remote Code Execution Vulnerability (Windows)	high
700710	Apache Tomcat 9.0.x < 9.0.16 DoS	medium
700709	Apache Tomcat 9.0.x < 9.0.12 Open Redirect Weakness	medium
700708	Apache Tomcat 9.0.x < 9.0.10 Multiple Vulnerabilities	high
700707	Apache Tomcat 9.0.x < 9.0.10 Security Misconfiguration	high

Web Servers Family for Nessus Network Monitor

medium

medium

medium

medium

medium

low

medium

medium

medium

high

high

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

medium

medium

high

high