VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago
Reset
More filters (2)
Columns
Published from 2005-01-01✕Published to 2005-12-31✕
Overview 24 matches, all in RASP scope · 3 protected · 0 KEV · 4 public PoC · 0 CISA SSVC · 0 EPSS ≥ 0.5 · 0 disputed
24matches, all in RASP scope 3protected12.5% 0KEV0.0% 4public PoC16.7% 0CISA SSVC0.0% 0EPSS ≥ 0.50.0% 0disputed0.0%
Critical 0 0.0% High 0 0.0% Medium 24 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 3 12.5% Rule in development 0 0.0% Mitigation candidate 3 12.5% No exploit published 4 16.7% No fix identified 14 58.3% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 3 12.5% not blocked 21 87.5% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 0 0.0% Working exploit published 4 16.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 20 83.3%
split by peak 10 / month
Unknown: 0None: 0Low: 0Medium: 24High: 0Critical: 0 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 14No exploit published: 4Mitigation candidate: 3Rule in development: 0Protected by RASP: 3 unrecorded: 0not established: 0not blocked: 21blocked by ARMR today: 3 No public exploit: 20Forecast only: 0Proof of concept only: 0Working exploit published: 4Exploited in the wild: 0 March 2005: 1 CVE April 2005: 0 CVEs May 2005: 6 CVEs June 2005: 0 CVEs July 2005: 3 CVEs August 2005: 0 CVEs September 2005: 0 CVEs October 2005: 0 CVEs November 2005: 4 CVEs December 2005: 10 CVEs
Mar 05Apr 05May 05Jun 05Jul 05Aug 05Sep 05Oct 05Nov 05Dec 05
24 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2005-4849 Medium 2005-12-31 No exploit published No public exploit Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.
CVE-2005-4838 Medium 2005-12-31 No fix identified No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the example web applications for Jakarta Tomcat 5.5.6 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) el/functions.jsp, (2) el/implicit-objects.jsp, and (3) jspx/textRotate.jspx in examples/jsp2/, as demonstrated via script in a request to snp/snoop.jsp. NOTE: other XSS issues in the manager were simultaneously reported, but these require admin access and do not cross privilege boundaries.
CVE-2005-4834 Medium 2005-12-31 No fix identified No public exploit IBM WebSphere Application Server (WAS) 5.0.2.5 through 5.1.1.3 allows remote attackers to obtain JSP source code and other sensitive information, related to incorrect request processing by the web container.
CVE-2005-4833 Medium 2005-12-31 No fix identified No public exploit IBM WebSphere Application Server (WAS) 6.0 before 20050201, when serving pages in an Application WAR or an Extended Document Root, allows remote attackers to obtain the JSP source code and other sensitive information via "a specific JSP URL," related to lack of normalization of the URL format.
CVE-2005-4805 Medium 2005-12-31 No fix identified No public exploit Unspecified vulnerability in Sun Java System Application Server 7 Standard and Platform Edition 6 and earlier, and 2004Q2 Standard and Platform Edition Update 2 and earlier, allows remote attackers to obtain the source code for Java Server pages (JSP) via unknown vectors.
CVE-2005-4804 Medium 2005-12-31 No fix identified No public exploit Unspecified vulnerability in Sun Java System Application Server Platform Edition and Enterprise Edition 8.1 2005 Q1, and Platform Edition UR1, allows remote attackers to read .jar files via unknown vectors related to deployed web applications.
CVE-2005-4703 Medium 2005-12-31 Mitigation candidate Working exploit published Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.
CVE-2005-4413 Medium 2005-12-20 No fix identified No public exploit Multiple cross-site scripting (XSS) vulnerabilities in sample scripts in IBM WebSphere Application Server 6 allow remote attackers to inject arbitrary web script or HTML via the (1) E-mail address field to (a) PlantsByWebSphere/login.jsp, (2) message field to (b) TechnologySample/BulletinBoard Script, (3) Email address field to (c) TechnologySamples/Subscription, and the (4) Movie Name, (5) Movie Reviewer, and (6) Movie Review fields to (d) TechnologySamples/MovieReview2_1.
CVE-2005-4294 Medium 2005-12-16 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page.
CVE-2005-4046 Medium 2005-12-07 No fix identified No public exploit Unspecified vulnerability in Reverse SSL Proxy Plug-in for Sun Java System Application Server Standard Edition 7 2004Q2, Application Server Enterprise Edition 8.1 2005Q1, and Sun ONE Application Server 7 Standard Edition, as used in multiple web servers, allows remote attackers to conduct man-in-the-middle (MITM) attacks and "compromise data privacy."
CVE-2005-3747 Medium 2005-11-22 Mitigation candidate Working exploit published Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash ("%5C") characters. NOTE: this might be the same issue as CVE-2006-2758.
CVE-2005-3745 Medium 2005-11-22 Protected by RASP Working exploit published Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.
CVE-2005-3510 Medium 2005-11-06 No exploit published No public exploit Apache Tomcat 5.5.0 to 5.5.11 allows remote attackers to cause a denial of service (CPU consumption) via a large number of simultaneous requests to list a web directory that has a large number of files.
CVE-2005-3498 Medium 2005-11-04 No fix identified No public exploit IBM WebSphere Application Server 5.0.x before 5.02.15, 5.1.x before 5.1.1.8, and 6.x before fixpack V6.0.2.5, when session trace is enabled, records a full URL including the queryString in the trace logs when an application encodes a URL, which could allow attackers to obtain sensitive information.
CVE-2005-2291 Medium 2005-07-18 No fix identified No public exploit Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 passes the cleartext password as a parameter when starting sqlplus, which allows local users to gain sensitive information.
CVE-2005-2091 Medium 2005-07-05 No fix identified No public exploit IBM WebSphere 5.1 and WebSphere 5.0 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes WebSphere to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVE-2005-2090 Medium 2005-07-05 No exploit published No public exploit Jakarta Tomcat 5.0.19 (Coyote/1.1) and Tomcat 4.1.24 (Coyote/1.0) allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes Tomcat to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVE-2005-1112 Medium 2005-05-02 Mitigation candidate Working exploit published IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine.
CVE-2005-1080 Medium 2005-05-02 Protected by RASP No public exploit Directory traversal vulnerability in the Java Archive Tool (Jar) utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in filenames in a .jar file.
CVE-2005-0808 Medium 2005-05-02 No fix identified No public exploit Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.
CVE-2005-0742 Medium 2005-05-02 No fix identified No public exploit Cross-site scripting (XSS) vulnerability in Sun Java System Application Server 7 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2005-0425 Medium 2005-05-02 No fix identified No public exploit Unknown vulnerability in IBM Websphere Application Server 5.0, 5.1, and 6.0 when running on Windows, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via a crafted URL that causes the page to be processed by the file serving servlet instead of the JSP engine.
CVE-2005-0223 Medium 2005-05-02 Protected by RASP No public exploit The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang) via object deserialization.
CVE-2005-0471 Medium 2005-03-14 No fix identified No public exploit Sun Java JRE 1.1.x through 1.4.x writes temporary files with long filenames that become predictable on a file system that uses 8.3 style short names, which allows remote attackers to write arbitrary files to known locations and facilitates the exploitation of vulnerabilities in applications that rely on unpredictable file names.