WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product one web server✕
Overview 12 matches · 2 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
12matches 2in Waratek scope16.7% 1protected8.3% 0exploited0.0% 0CISA KEV0.0% 1public PoC8.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 8.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 8.3% Outside Waratek scope 1 8.3% Not applicable 9 75.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 1 8.3% Medium 10 83.3% Low 1 8.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 8.3% partly blocked 0 0.0% not blocked 11 91.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 8.3% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 11 91.7%
split by peak 5 / year
Not applicable: 9Outside Waratek scope: 1No exploit published: 1Protected by Waratek: 1 Low: 1Medium: 10High: 1 not blocked: 11blocked by ARMR today: 1 No public exploit: 11Working exploit published: 1
20021 Not applicable1 Medium1 not blocked1 Working exploit published1 20031 Not applicable1 Medium1 not blocked1 No public exploit1 20041 Outside Waratek scope1 High1 not blocked1 No public exploit1 20051 Not applicable1 Medium1 not blocked1 No public exploit1 20061 No exploit published1 Medium1 not blocked1 No public exploit1 20070 20080 20092 Protected by Waratek1 Not applicable1 Medium2 blocked by ARMR today1 not blocked1 No public exploit2 20105 Not applicable5 Medium4 Low1 not blocked5 No public exploit5
200220032004200520062007200820092010
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2003-1590 Medium 2010-02-25 Not applicable No public exploit Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 6.0 SP3 through SP5 on Windows allows remote attackers to cause a denial of service (daemon crash) via unknown vectors.
CVE-2003-1589 Medium 2010-02-25 Not applicable No public exploit Unspecified vulnerability in Sun ONE (aka iPlanet) Web Server 4.1 before SP13 and 6.0 before SP6 on Windows allows attackers to cause a denial of service (daemon crash) via unknown vectors.
CVE-2003-1579 Medium 2010-02-05 Not applicable No public exploit Sun ONE (aka iPlanet) Web Server 6 on Windows, when DNS resolution is enabled for client IP addresses, uses a logging format that does not identify whether a dotted quad represents an unresolved IP address, which allows remote attackers to spoof IP addresses via crafted DNS responses containing numerical top-level domains, as demonstrated by a forged 123.123.123.123 domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVE-2003-1578 Medium 2010-02-05 Not applicable No public exploit Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to hide HTTP requests from the log-preview functionality by accompanying the requests with crafted DNS responses specifying a domain name beginning with a "format=" substring, related to an "Inverse Lookup Log Corruption (ILLC)" issue.
CVE-2003-1577 Low 2010-02-05 Not applicable No public exploit Sun ONE (aka iPlanet) Web Server 4.1 through SP12 and 6.0 through SP5, when DNS resolution is enabled for client IP addresses, allows remote attackers to inject arbitrary text into log files, and conduct cross-site scripting (XSS) attacks involving the iPlanet Log Analyzer, via an HTTP request in conjunction with a crafted DNS response, related to an "Inverse Lookup Log Corruption (ILLC)" issue, a different vulnerability than CVE-2002-1315 and CVE-2002-1316.
CVE-2009-1934 Medium 2009-06-05 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the Reverse Proxy Plug-in in Sun Java System Web Server 6.1 before SP11 allows remote attackers to inject arbitrary web script or HTML via the query string in situations that result in a 502 Gateway error.
CVE-2004-2763 Medium 2009-06-01 Protected by Waratek No public exploit The default configuration of Sun ONE/iPlanet Web Server 4.1 SP1 through SP12 and 6.0 SP1 through SP5 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
CVE-2006-2501 Medium 2006-05-20 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving error messages.
CVE-2005-2094 Medium 2005-07-05 Not applicable No public exploit Sun SunONE web server 6.1 SP1 allows remote attackers to poison the web cache, bypass web application firewall protection, and conduct XSS attacks via an HTTP request with both a "Transfer-Encoding: chunked" header and a Content-Length header, which causes SunONE to incorrectly handle and forward the body of the request in a way that causes the receiving server to process it as a separate HTTP request, aka "HTTP Request Smuggling."
CVE-2004-0826 High 2004-12-31 Outside Waratek scope No public exploit Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message.
CVE-2003-1126 Medium 2003-12-31 Not applicable No public exploit Unknown vulnerability in SunOne/iPlanet Web Server SP3 through SP5 on Windows platforms allows remote attackers to cause a denial of service.
CVE-2002-1042 Medium 2002-10-04 Not applicable Working exploit published Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read arbitrary files via ..\ (dot-dot backslash) sequences in the NS-query-pat parameter.