WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Enterprise Manager Grid Control / Enterprise Manager Ops Center✕
Overview 12 matches · 4 in Waratek scope · 1 protected · 1 exploited · 0 CISA KEV · 4 public PoC · 4 EPSS ≥ 0.5
12matches 4in Waratek scope33.3% 1protected8.3% 1exploited8.3% 0CISA KEV0.0% 4public PoC33.3% 4EPSS ≥ 0.533.3%
Protected by Waratek 1 8.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 25.0% Outside Waratek scope 3 25.0% Not applicable 5 41.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 3 25.0% Medium 7 58.3% Low 2 16.7% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 8.3% partly blocked 0 0.0% not blocked 11 91.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 8.3% Working exploit published 1 8.3% Proof of concept only 2 16.7% Forecast only 1 8.3% No public exploit 7 58.3%
split by peak 2 / quarter
Not applicable: 5Outside Waratek scope: 3No exploit published: 3Protected by Waratek: 1 Low: 2Medium: 7High: 3 not blocked: 11blocked by ARMR today: 1 No public exploit: 7Forecast only: 1Proof of concept only: 2Working exploit published: 1Exploited: 1
Q1 131 Not applicable1 Medium1 not blocked1 No public exploit1 Q2 130 Q3 130 Q4 132 Protected by Waratek1 Not applicable1 High1 Medium1 blocked by ARMR today1 not blocked1 Proof of concept only1 No public exploit1 Q1 140 Q2 141 Outside Waratek scope1 High1 not blocked1 Exploited1 Q3 141 Outside Waratek scope1 Medium1 not blocked1 Working exploit published1 Q4 141 Outside Waratek scope1 Low1 not blocked1 Proof of concept only1 Q1 151 No exploit published1 Medium1 not blocked1 No public exploit1 Q2 151 Not applicable1 Medium1 not blocked1 No public exploit1 Q3 151 Not applicable1 Medium1 not blocked1 No public exploit1 Q4 151 No exploit published1 Low1 not blocked1 No public exploit1 Q1 160 Q2 161 No exploit published1 Medium1 not blocked1 No public exploit1 Q3 161 Not applicable1 High1 not blocked1 Forecast only1
Q1 13Q3 13Q1 14Q3 14Q1 15Q3 15Q1 16Q3 16
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2016-6304 High 2016-09-26 Not applicable Forecast only Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
CVE-2016-0734 Medium 2016-04-07 No exploit published No public exploit The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
CVE-2015-2633 Low 2015-10-21 No exploit published No public exploit Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 12.1.0.1 and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Ops Center.
CVE-2015-5505 Medium 2015-08-18 Not applicable No public exploit The HTTP Strict Transport Security (HSTS) module 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.2 for Drupal does not properly implement the "include subdomains" directive, which causes the HSTS policy to not be applied to subdomains and allows man-in-the-middle attackers to have unspecified impact via unknown vectors.
CVE-2015-3237 Medium 2015-06-22 Not applicable No public exploit The smb_request_state function in cURL and libcurl 7.40.0 through 7.42.1 allows remote SMB servers to obtain sensitive information from memory or cause a denial of service (out-of-bounds read and crash) via crafted length and offset values.
CVE-2014-6573 Medium 2015-01-21 No exploit published No public exploit Unspecified vulnerability in the Enterprise Manager Ops Center component in Oracle Enterprise Manager Grid Control 11.1.3 and 12.1.4 allows remote attackers to affect integrity via unknown vectors related to User Interface Framework.
CVE-2014-3566 Low 2014-10-15 Outside Waratek scope Proof of concept only The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.
CVE-2014-0226 Medium 2014-07-20 Outside Waratek scope Working exploit published Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.
CVE-2014-0224 High 2014-06-05 Outside Waratek scope Exploited OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.
CVE-2013-4545 Medium 2013-11-23 Not applicable No public exploit cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2013-2186 High 2013-10-28 Protected by Waratek Proof of concept only The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
CVE-2013-1620 Medium 2013-02-08 Not applicable No public exploit The TLS implementation in Mozilla Network Security Services (NSS) does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.