Tomcat versions 3.3 through 3.3.2 suffer from a cross site scripting vulnerability.
36084975dae6956494d65e72bd4a33f442d3b4c6dbbdb2fd1b7ce7a52906b08a
Tomcat versions 4.0.0 to 4.0.6 and 4.1.0 to 4.1.36 suffer from a cross site scripting vulnerability.
18d606dd2290c995c57c23bf0c1b1e49d55196f30e1dcbb36548399e8febeefe