Overview 34 matches · 6 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
34matches
6in Waratek scope17.6%
0protected0.0%
1exploited2.9%
0CISA KEV0.0%
3public PoC8.8%
1EPSS ≥ 0.52.9%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
6
17.6%
Outside Waratek scope
0
0.0%
Not applicable
28
82.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
34
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
2.9%
Working exploit published
3
8.8%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
30
88.2%
split by
peak 8 / year
20002
Not applicable2
High2
not blocked2
No public exploit2
20010
20020
20030
20041
No exploit published1
Medium1
not blocked1
No public exploit1
20052
Not applicable2
Medium2
not blocked2
No public exploit2
20064
No exploit published3
Not applicable1
Medium4
not blocked4
No public exploit4
20078
No exploit published1
Not applicable7
High3
Medium5
not blocked8
No public exploit8
20084
No exploit published1
Not applicable3
Medium4
not blocked4
No public exploit4
20095
Not applicable5
High1
Medium3
Low1
not blocked5
Exploited1
No public exploit4
20107
Not applicable7
High6
Medium1
not blocked7
Working exploit published3
No public exploit4
20110
20121
Not applicable1
Medium1
not blocked1
No public exploit1
2000200220042006200820102012
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2012-1738 | Medium | 2012-07-17 | Not applicable | No public exploit | Unspecified vulnerability in the Oracle iPlanet Web Server component in Oracle Sun Products Suite Java System Web Server 6.1 and Oracle iPlanet Web Server 7.0 allows remote attackers to affect availability via unknown vectors related to Web Server. |
| CVE-2010-0389 | Medium | 2010-01-25 | Not applicable | No public exploit | The admin server in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an HTTP request that lacks a method token. |
| CVE-2010-0388 | High | 2010-01-25 | Not applicable | Working exploit published | Format string vulnerability in the WebDAV implementation in webservd in Sun Java System Web Server 7.0 Update 6 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via format string specifiers in the encoding attribute of the XML declaration in a PROPFIND request. |
| CVE-2010-0387 | High | 2010-01-25 | Not applicable | Working exploit published | Multiple heap-based buffer overflows in (1) webservd and (2) the admin server in Sun Java System Web Server 7.0 Update 7 allow remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long string in an "Authorization: Digest" HTTP header. |
| CVE-2010-0361 | High | 2010-01-20 | Not applicable | Working exploit published | Stack-based buffer overflow in the WebDAV implementation in webservd in Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to cause a denial of service (daemon crash) and possibly have unspecified other impact via a long URI in an HTTP OPTIONS request. |
| CVE-2010-0360 | High | 2010-01-20 | Not applicable | No public exploit | Sun Java System Web Server (aka SJWS) 7.0 Update 7 allows remote attackers to overwrite memory locations in the heap, and discover the contents of memory locations, via a malformed HTTP TRACE request that includes a long URI and many empty headers, related to an "overflow." NOTE: this might overlap CVE-2010-0272 and CVE-2010-0273. |
| CVE-2010-0273 | High | 2010-01-08 | Not applicable | No public exploit | Unspecified vulnerability in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to execute arbitrary code by sending a process memory address and crafted data to TCP port 80, as demonstrated by the vd_sjws2 module in VulnDisco. NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. |
| CVE-2010-0272 | High | 2010-01-08 | Not applicable | No public exploit | Heap-based buffer overflow in Sun Java System Web Server 7.0 Update 6 on Linux allows remote attackers to discover process memory locations via crafted data to TCP port 80, as demonstrated by the vd_sjws2 module in VulnDisco. NOTE: as of 20100106, this disclosure has no actionable information. However, because the VulnDisco author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. |
| CVE-2009-3878 | High | 2009-11-05 | Not applicable | No public exploit | Buffer overflow in Sun Java System Web Server 7.0 Update 6 has unspecified impact and remote attack vectors, as demonstrated by the vd_sjws module in VulnDisco Pack Professional 8.12. NOTE: as of 20091105, this disclosure has no actionable information. However, because the VulnDisco Pack author is a reliable researcher, the issue is being assigned a CVE identifier for tracking purposes. |
| CVE-2009-2713 | Medium | 2009-08-07 | Not applicable | No public exploit | The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that "policy advice" is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors. |
| CVE-2009-2712 | Low | 2009-08-07 | Not applicable | No public exploit | Sun Java System Access Manager 6.3 2005Q1, 7.0 2005Q4, and 7.1; and OpenSSO Enterprise 8.0; when AMConfig.properties enables the debug flag, allows local users to discover cleartext passwords by reading debug files. |
| CVE-2009-2445 | Medium | 2009-07-13 | Not applicable | Exploited | Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as demonstrated by a .jsp::$DATA URI. |
| CVE-2009-1934 | Medium | 2009-06-05 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Reverse Proxy Plug-in in Sun Java System Web Server 6.1 before SP11 allows remote attackers to inject arbitrary web script or HTML via the query string in situations that result in a 502 Gateway error. |
| CVE-2008-3425 | Medium | 2008-07-31 | Not applicable | No public exploit | Unspecified vulnerability in the Sun Java System Web Server 7.0 plugin in Sun N1 Service Provisioning System (SPS) 5.2 and 6.0 allows remote authenticated SPS users to gain administrative access to the web server via unknown attack vectors. |
| CVE-2008-2518 | Medium | 2008-06-03 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the advanced search mechanism (webapps/search/advanced.jsp) in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, probably related to the next parameter. |
| CVE-2008-2166 | Medium | 2008-05-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the search module in Sun Java System Web Server 6.1 before SP9 and 7.0 before Update 2 allows remote attackers to inject arbitrary web script or HTML via unknown parameters in index.jsp. |
| CVE-2008-2120 | Medium | 2008-05-09 | No exploit published | No public exploit | Unspecified vulnerability in Sun Java System Application Server 7 2004Q2 before Update 6, Web Server 6.1 before SP8, and Web Server 7.0 before Update 1 allows remote attackers to obtain source code of JSP files via unknown vectors. |
| CVE-2007-6572 | Medium | 2007-12-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Sun Java System Web Server 6.1 before SP8 and 7.0 before Update 1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566204. |
| CVE-2007-6571 | Medium | 2007-12-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Sun Java System Web Proxy Server 3.6 before SP11 on Windows allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6611356. |
| CVE-2007-6570 | Medium | 2007-12-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the View URL Database functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 and 3.x before 3.6 SP11 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566309. |
| CVE-2007-6569 | Medium | 2007-12-28 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the View Error Log functionality in Sun Java System Web Proxy Server 4.x before 4.0.6 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka BugID 6566246. |
| CVE-2007-4164 | High | 2007-08-07 | Not applicable | No public exploit | CRLF injection vulnerability in the redirect feature in Sun Java System Web Server 6.1 and 7.0 before 20070802, when the redirect Server Application Function (SAF) uses the url-prefix parameter and escape is disabled, or an Error directive uses the url-prefix parameter in obj.conf, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. |
| CVE-2007-3715 | High | 2007-07-11 | No exploit published | No public exploit | Sun Java System Application Server and Web Server 7.0 through 9.0 before 20070710 do not properly process XSLT stylesheets in XSLT transforms in XML signatures, which allows context-dependent attackers to execute an arbitrary Java method via a crafted stylesheet, a related issue to CVE-2007-3716. |
| CVE-2007-1526 | Medium | 2007-03-20 | Not applicable | No public exploit | Sun Java System Web Server 6.1 before 20070314 allows remote authenticated users with revoked client certificates to bypass the Certificate Revocation List (CRL) authorization control and access secure web server instances running under an account different from that used for the admin server via unspecified vectors. |
| CVE-2007-1488 | High | 2007-03-16 | Not applicable | No public exploit | Unspecified vulnerability in Sun Java System Web Server 6.0 and 6.1 before 20070315 allows remote attackers to "gain unauthorized access to data", possibly involving a sample application. |
| CVE-2006-6276 | Medium | 2006-12-04 | No exploit published | No public exploit | HTTP request smuggling vulnerability in Sun Java System Proxy Server before 20061130, when used with Sun Java System Application Server or Sun Java System Web Server, allows remote attackers to bypass HTTP request filtering, hijack web sessions, perform cross-site scripting (XSS), and poison web caches via unspecified attack vectors. |
| CVE-2006-5654 | Medium | 2006-11-03 | Not applicable | No public exploit | Unspecified vulnerability in the Network Security Services (NSS) in Sun Java System Web Server 6.0 before SP 10 and ONE Application Server 7 before Update 3, when SSLv2 is enabled, allows remote authenticated users to cause a denial of service (application crash) via unspecified vectors. NOTE: due to lack of details from the vendor, it is unclear whether this is related to vector 1 in CVE-2006-5201 or CVE-2006-3127. |
| CVE-2006-3921 | Medium | 2006-07-28 | No exploit published | No public exploit | Sun Java System Application Server (SJSAS) 7 through 8.1 and Web Server (SJSWS) 6.0 and 6.1 allows remote authenticated users to read files outside of the "document root directory" via a direct request using a UTF-8 encoded URI. |
| CVE-2006-2501 | Medium | 2006-05-20 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving error messages. |
| CVE-2005-1889 | Medium | 2005-06-07 | Not applicable | No public exploit | Unknown vulnerability in Sun ONE Application Server 6.5 SP1 Maintenance Update 6 and earlier allows attackers to read files. |
| CVE-2005-1150 | Medium | 2005-05-02 | Not applicable | No public exploit | Unknown vulnerability in Sun Java System Web Server 6.0 SP7 and earlier, when running on Windows systems, allows attackers to cause a denial of service (hang). |
| CVE-2004-2216 | Medium | 2004-12-31 | No exploit published | No public exploit | Unknown vulnerability in Sun Java System Web Server 6.0 SP7 and earlier and 6.1 SP1 and earlier, and Application Server 7 Update 4 and earlier, allows remote attackers to cause a denial of service (crash) via a malformed client certificate. |
| CVE-2000-0812 | High | 2000-11-14 | Not applicable | No public exploit | The administration module in Sun Java web server allows remote attackers to execute arbitrary commands by uploading Java code to the module and invoke the com.sun.server.http.pagecompile.jsp92.JspServlet by requesting a URL that begins with a /servlet/ tag. |
| CVE-2000-0629 | High | 2000-07-12 | Not applicable | No public exploit | The default configuration of the Sun Java web server 2.0 and earlier allows remote attackers to execute arbitrary commands by uploading Java code to the server via board.html, then directly calling the JSP compiler servlet. |