Overview 7 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
14.3%
No exploit published
6
85.7%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
7
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
14.3%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
6
85.7%
split by
peak 3 / year
20033
Mitigation candidate1
No exploit published2
Medium3
not blocked3
Working exploit published1
No public exploit2
20040
20050
20060
20071
No exploit published1
Medium1
not blocked1
No public exploit1
20080
20090
20100
20110
20120
20130
20140
20150
20160
20170
20183
No exploit published3
High1
Medium2
not blocked3
No public exploit3
20042006200820102012201420162018
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2018-8032 | Medium | 2018-08-02 | No exploit published | No public exploit | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. |
| CVE-2018-1258 | High | 2018-05-11 | No exploit published | No public exploit | Spring Framework version 5.0.5 when used in combination with any versions of Spring Security contains an authorization bypass when using method security. An unauthorized malicious user can gain unauthorized access to methods that should be restricted. |
| CVE-2018-1257 | Medium | 2018-05-11 | No exploit published | No public exploit | Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack. |
| CVE-2007-5576 | Medium | 2007-10-18 | No exploit published | No public exploit | BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands. |
| CVE-2003-0623 | Medium | 2003-12-01 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE argument. |
| CVE-2003-0622 | Medium | 2003-12-01 | No exploit published | No public exploit | The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such as CON and AUX. |
| CVE-2003-0621 | Medium | 2003-12-01 | Mitigation candidate | Working exploit published | The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument. |