WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2002-03-31✕Product application✕
Overview 13 matches · 1 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
13matches 1protected7.7% 0exploited0.0% 0CISA KEV0.0% 2public PoC15.4% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 7.7% Rule in development 0 0.0% Mitigation candidate 2 15.4% No exploit published 10 76.9%
Critical 0 0.0% High 7 53.8% Medium 6 46.2% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 7.7% partly blocked 0 0.0% not blocked 12 92.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 15.4% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 11 84.6%
split by peak 4 / quarter
No exploit published: 10Mitigation candidate: 2Protected by Waratek: 1 Medium: 6High: 7 not blocked: 12blocked by ARMR today: 1 No public exploit: 11Working exploit published: 2
Q4 991 No exploit published1 High1 not blocked1 No public exploit1 Q1 000 Q2 001 No exploit published1 High1 not blocked1 No public exploit1 Q3 001 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Q4 000 Q1 010 Q2 011 No exploit published1 High1 not blocked1 No public exploit1 Q3 014 Protected by Waratek1 Mitigation candidate1 No exploit published2 High2 Medium2 blocked by ARMR today1 not blocked3 Working exploit published1 No public exploit3 Q4 012 No exploit published2 High1 Medium1 not blocked2 No public exploit2 Q1 023 No exploit published3 High1 Medium2 not blocked3 No public exploit3
Q4 99Q1 00Q2 00Q3 00Q4 00Q1 01Q2 01Q3 01Q4 01Q1 02
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2002-1637 Medium 2002-02-26 No exploit published No public exploit Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5) IMAGEUSER, (6) USER1, (7) USER2, (8) PLSQL, (9) DEMO, (10) FINANCE, and many others, which allows attackers to gain privileges.
CVE-2001-1372 Medium 2002-02-06 No exploit published No public exploit Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.
CVE-2001-1371 High 2002-02-06 No exploit published No public exploit The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.
CVE-2001-1189 Medium 2001-12-13 No exploit published No public exploit IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.props file, which allows local users to obtain the passwords via a JSP script.
CVE-2001-0824 High 2001-12-06 No exploit published No public exploit Cross-site scripting vulnerability in IBM WebSphere 3.02 and 3.5 FP2 allows remote attackers to execute Javascript by inserting the Javascript into (1) a request for a .JSP file, or (2) a request to the webapp/examples/ directory, which inserts the Javascript into an error page.
CVE-2001-0962 High 2001-09-19 No exploit published No public exploit IBM WebSphere Application Server 3.02 through 3.53 uses predictable session IDs for cookies, which allows remote attackers to gain privileges of WebSphere users via brute force guessing.
CVE-2001-0591 High 2001-08-22 Protected by Waratek No public exploit Directory traversal vulnerability in Oracle JSP 1.0.x through 1.1.1 and Oracle 8.1.7 iAS Release 1.0.2 can allow a remote attacker to read or execute arbitrary .jsp files via a '..' (dot dot) attack.
CVE-2001-0390 Medium 2001-07-02 Mitigation candidate Working exploit published IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters.
CVE-2001-0389 Medium 2001-07-02 No exploit published No public exploit IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to determine the real path of the server by directly calling the macro.d2w macro with a NOEXISTINGHTMLBLOCK argument.
CVE-2001-0326 High 2001-05-03 No exploit published No public exploit Oracle Java Virtual Machine (JVM ) for Oracle 8.1.7 and Oracle Application Server 9iAS Release 1.0.2.0.1 allows remote attackers to read arbitrary files via the .jsp and .sqljsp file extensions when the server is configured to use the <<ALL FILES>> FilePermission.
CVE-2000-0652 Medium 2000-07-24 Mitigation candidate Working exploit published IBM WebSphere allows remote attackers to read source code for executable web files by directly calling the default InvokerServlet using a URL which contains the "/servlet/file" string.
CVE-2000-0497 High 2000-06-08 No exploit published No public exploit IBM WebSphere server 3.0.2 allows a remote attacker to view source code of a JSP program by requesting a URL which provides the JSP extension in upper case.
CVE-1999-0852 High 1999-12-02 No exploit published No public exploit IBM WebSphere sets permissions that allow a local user to modify a deinstallation script or its data files stored in /usr/bin.