Requesting the URI /status gives information about the currently running Tomcat. It also allows anybody to reset (ie: permanently delete) the current statistics.

If you don't use this feature, comment the appropriate section in your httpd.conf file. If you really need it, limit its access to the administrator's machine.