WaratekVRT Sign in

Exploited Web Services CVEs

4 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Product web services✕
Overview 4 matches · 3 protected · 2 CISA KEV · 2 public PoC · 3 EPSS ≥ 0.5
4matches 3protected75.0% 2CISA KEV50.0% 2public PoC50.0% 3EPSS ≥ 0.575.0%
Protected by Waratek 3 75.0% Rule in development 0 0.0% Mitigation candidate 1 25.0% No exploit published 0 0.0%
Critical 3 75.0% High 0 0.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 75.0% partly blocked 0 0.0% not blocked 0 0.0% not established 1 25.0% unrecorded 0 0.0%
Exploited 4 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / year
Mitigation candidate: 1Protected by Waratek: 3 Medium: 1Critical: 3 not established: 1blocked by ARMR today: 3 Exploited: 4
20161 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20170 20180 20190 20200 20211 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20220 20231 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20240 20250 20261 Mitigation candidate1 Critical1 not established1 Exploited1
20162017201820192020202120222023202420252026
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-21992 Critical 2026-03-20 Mitigation candidate Exploited Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager and Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager and Oracle Web Services Manager. Note: Oracle Web Services Manager is installed with an Oracle Fusion Middleware Infrastructure. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2023-46604 Critical 2023-10-27 Protected by Waratek Exploited The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to run arbitrary shell commands by manipulating serialized class types in the OpenWire protocol to cause either the client or the broker (respectively) to instantiate any class on the classpath. Users are recommended to upgrade both brokers and clients to version 5.15.16, 5.16.7, 5.17.6, or 5.18.3 which fixes this issue.
CVE-2021-34429 Medium 2021-07-15 Protected by Waratek Exploited For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
CVE-2016-3427 Critical 2016-04-21 Protected by Waratek Exploited Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.