WaratekVRT Sign in

Medium CWE-255 CVEs

7 CVEs

Reset
More filters (1)
Columns
CWE CWE-255✕
Overview 7 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
7matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 7 100.0%
Critical 0 0.0% High 0 0.0% Medium 7 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 100.0%
split by peak 2 / year
No exploit published: 7 Medium: 7 not blocked: 7 No public exploit: 7
20042 No exploit published2 Medium2 not blocked2 No public exploit2 20050 20060 20070 20080 20090 20100 20110 20122 No exploit published2 Medium2 not blocked2 No public exploit2 20130 20141 No exploit published1 Medium1 not blocked1 No public exploit1 20151 No exploit published1 Medium1 not blocked1 No public exploit1 20160 20171 No exploit published1 Medium1 not blocked1 No public exploit1
2005200720092011201320152017
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2016-6815 Medium 2017-10-13 No exploit published No public exploit In Apache Ranger before 0.6.2, users with "keyadmin" role should not be allowed to change password for users with "admin" role.
CVE-2015-6524 Medium 2015-08-24 No exploit published No public exploit The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows wildcard operators in usernames, which allows remote attackers to obtain credentials via a brute force attack. NOTE: this identifier was SPLIT from CVE-2014-3612 per ADT2 due to different vulnerability types.
CVE-2014-3068 Medium 2014-12-02 No exploit published No public exploit IBM Java Runtime Environment (JRE) 7 R1 before SR1 FP1 (7.1.1.1), 7 before SR7 FP1 (7.0.7.1), 6 R1 before SR8 FP1 (6.1.8.1), 6 before SR16 FP1 (6.0.16.1), and before 5.0 SR16 FP7 (5.0.16.7) allows attackers to obtain the private key from a Certificate Management System (CMS) keystore via a brute force attack.
CVE-2012-3428 Medium 2012-12-20 No exploit published No public exploit The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource connection in opportunistic circumstances via an invalid connection attempt.
CVE-2012-3306 Medium 2012-09-25 No exploit published No public exploit IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.45, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1, when multi-domain support is configured, does not purge password data from the authentication cache, which has unspecified impact and remote attack vectors.
CVE-2004-2696 Medium 2004-12-31 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user identity" to be used in an RMI call.
CVE-2004-1366 Medium 2004-08-04 No exploit published No public exploit Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.