WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Database Server / Application Express✕
Overview 14 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
14matches 1in Waratek scope7.1% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC7.1% 1EPSS ≥ 0.57.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 7.1% No exploit published 0 0.0% Outside Waratek scope 10 71.4% Not applicable 3 21.4% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 1 7.1% Medium 12 85.7% Low 1 7.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 7.1% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 13 92.9%
split by peak 3 / year
Not applicable: 3Outside Waratek scope: 10Mitigation candidate: 1 Low: 1Medium: 12High: 1 not blocked: 14 No public exploit: 13Working exploit published: 1
20101 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 20111 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 20121 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 20131 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 20143 Mitigation candidate1 Outside Waratek scope2 High1 Medium2 not blocked3 Working exploit published1 No public exploit2 20153 Outside Waratek scope3 Medium2 Low1 not blocked3 No public exploit3 20162 Not applicable2 Medium2 not blocked2 No public exploit2 20170 20181 Not applicable1 Medium1 not blocked1 No public exploit1 20191 Outside Waratek scope1 Medium1 not blocked1 No public exploit1
2010201120122013201420152016201720182019
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-2484 Medium 2019-07-23 Outside Waratek scope No public exploit Vulnerability in the Application Express component of Oracle Database Server. Supported versions that are affected are 5.1 and 18.2. Easily exploitable vulnerability allows low privileged attacker having Valid Account privilege with network access via HTTP to compromise Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Express accessible data as well as unauthorized read access to a subset of Application Express accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).
CVE-2018-2699 Medium 2018-01-18 Not applicable No public exploit Vulnerability in the Application Express component of Oracle Database Server. The supported version that is affected is Prior to 5.1.4.00.08. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Express. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Application Express, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Application Express accessible data as well as unauthorized read access to a subset of Application Express accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVE-2016-3467 Medium 2016-07-21 Not applicable No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.4 allows remote attackers to affect availability via unknown vectors.
CVE-2016-3448 Medium 2016-07-21 Not applicable No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0.4 allows remote attackers to affect confidentiality and integrity via unknown vectors.
CVE-2015-2655 Medium 2015-07-16 Outside Waratek scope No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server before 4.2.3.00.08 allows remote authenticated users to affect confidentiality and integrity via unknown vectors.
CVE-2015-2586 Medium 2015-07-16 Outside Waratek scope No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server before 4.2.1 allows remote attackers to affect availability via unknown vectors.
CVE-2015-2585 Low 2015-07-16 Outside Waratek scope No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server before 5.0 allows remote authenticated users to affect availability via unknown vectors.
CVE-2010-5312 Medium 2014-11-24 Outside Waratek scope No public exploit Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
CVE-2014-6483 Medium 2014-10-15 Outside Waratek scope No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server before 4.2.6 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2014-0050 High 2014-04-01 Mitigation candidate Working exploit published MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
CVE-2013-1519 Medium 2013-04-17 Outside Waratek scope No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server before 4.2.1 allows remote attackers to affect integrity via unknown vectors.
CVE-2012-1708 Medium 2012-05-03 Outside Waratek scope No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server 4.0 and 4.1 allows remote attackers to affect integrity via unknown vectors.
CVE-2011-3525 Medium 2011-10-18 Outside Waratek scope No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server 3.2 and 4.0 allows remote authenticated users to affect confidentiality, integrity, and availability, related to APEX developer user.
CVE-2010-0892 Medium 2010-07-13 Outside Waratek scope No public exploit Unspecified vulnerability in the Application Express component in Oracle Database Server 3.2.0.00.27 allows remote attackers to affect integrity via unknown vectors.