WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2006-04-01✕Published to 2006-06-30✕
Overview 35 matches · 1 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
35matches 1protected2.9% 0exploited0.0% 0CISA KEV0.0% 3public PoC8.6% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 2.9% Rule in development 0 0.0% Mitigation candidate 2 5.7% No exploit published 32 91.4%
Critical 0 0.0% High 15 42.9% Medium 17 48.6% Low 3 8.6% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 2.9% partly blocked 0 0.0% not blocked 34 97.1% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 8.6% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 32 91.4%
split by peak 22 / month
No exploit published: 32Mitigation candidate: 2Protected by Waratek: 1 Low: 3Medium: 17High: 15 not blocked: 34blocked by ARMR today: 1 No public exploit: 32Working exploit published: 3
Apr 068 No exploit published8 High7 Medium1 not blocked8 No public exploit8 May 0622 Mitigation candidate2 No exploit published20 High7 Medium13 Low2 not blocked22 Working exploit published2 No public exploit20 Jun 065 Protected by Waratek1 No exploit published4 High1 Medium3 Low1 blocked by ARMR today1 not blocked4 Working exploit published1 No public exploit4
Apr 06May 06Jun 06
35 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2006-3232 High 2006-06-27 No exploit published No public exploit Unspecified vulnerability in IBM WebSphere Application Server before 6.0.2.11 has unknown impact and attack vectors because the "UserNameToken cache was improperly used."
CVE-2006-3231 Medium 2006-06-27 No exploit published No public exploit Unspecified vulnerability in IBM WebSphere Application Server (WAS) before 6.0.2.11, when fileServingEnabled is true, allows remote attackers to obtain JSP source code and other sensitive information via "URIs with special characters."
CVE-2006-3225 Low 2006-06-26 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Sun ONE Application Server 7 before Update 9, Java System Application Server 7 2004Q2 before Update 5, and Java System Application Server Enterprise Edition 8.1 2005 Q1 allows remote attackers to inject arbitrary HTML or web script via unknown vectors.
CVE-2006-2759 Medium 2006-06-02 No exploit published No public exploit jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary script source code via a capital P in the .jsp extension, and probably other mixed case manipulations.
CVE-2006-2758 Medium 2006-06-02 Protected by Waratek Working exploit published Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded ../) in the URL. NOTE: this might be the same issue as CVE-2005-3747.
CVE-2006-2571 Low 2006-05-24 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action.
CVE-2006-2546 Medium 2006-05-23 No exploit published No public exploit A recommended admin password reset mechanism for BEA WebLogic Server 8.1, when followed before October 10, 2005, causes the administrator password to be stored in cleartext in the domain directory, which could allow attackers to gain privileges.
CVE-2006-2501 Medium 2006-05-20 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Sun ONE Web Server 6.0 SP9 and earlier, Java System Web Server 6.1 SP4 and earlier, Sun ONE Application Server 7 Platform and Standard Edition Update 6 and earlier, and Java System Application Server 7 2004Q2 Standard and Enterprise Edition Update 2 and earlier, allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors, possibly involving error messages.
CVE-2006-2472 Medium 2006-05-19 No exploit published No public exploit Unspecified vulnerability in BEA WebLogic Server 9.1 and 9.0, 8.1 through SP5, 7.0 through SP6, and 6.1 through SP7 allows untrusted applications to obtain private server keys.
CVE-2006-2471 Medium 2006-05-19 No exploit published No public exploit Multiple vulnerabilities in BEA WebLogic Server 8.1 through SP4, 7.0 through SP6, and 6.1 through SP7 leak sensitive information to remote attackers, including (1) DNS and IP addresses to address to T3 clients, (2) internal sensitive information using GetIORServlet, (3) certain "server details" in exceptions when invalid XML is provided, and (4) a stack trace in a SOAP fault.
CVE-2006-2470 High 2006-05-19 No exploit published No public exploit Unspecified vulnerability in the WebLogic Server Administration Console for BEA WebLogic Server 9.0 prevents the console from setting custom JDBC security policies correctly, which could allow attackers to bypass intended policies.
CVE-2006-2469 High 2006-05-19 No exploit published No public exploit The HTTP handlers in BEA WebLogic Server 9.0, 8.1 up to SP5, 7.0 up to SP6, and 6.1 up to SP7 stores the username and password in cleartext in the WebLogic Server log when access to a web application or protected JWS fails, which allows attackers to gain privileges.
CVE-2006-2468 Medium 2006-05-19 No exploit published No public exploit The WebLogic Server Administration Console in BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 displays the domain name in the Console login form, which allows remote attackers to obtain sensitive information.
CVE-2006-2467 Medium 2006-05-19 No exploit published No public exploit BEA WebLogic Server 8.1 up to SP4, 7.0 up to SP6, and 6.1 up to SP7 displays the internal IP address of the WebLogic server in the WebLogic Server Administration Console, which allows remote authenticated administrators to determine the address.
CVE-2006-2466 Low 2006-05-19 No exploit published No public exploit BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a "timing window" when a compilation error occurs, aka the "JSP showcode vulnerability."
CVE-2006-2464 Medium 2006-05-19 No exploit published No public exploit stopWebLogic.sh in BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6 displays the administrator password to stdout when executed, which allows local users to obtain the password by viewing a local display.
CVE-2006-2462 Medium 2006-05-19 No exploit published No public exploit BEA WebLogic Server 8.1 before Service Pack 4 and 7.0 before Service Pack 6, may send sensitive data over non-secure channels when using JTA transactions, which allows remote attackers to read potentially sensitive network traffic.
CVE-2006-2461 Medium 2006-05-19 No exploit published No public exploit BEA WebLogic Server before 8.1 Service Pack 4 does not properly set the Quality of Service in certain circumstances, which prevents some transmissions from being encrypted via SSL, and allows remote attackers to more easily read potentially sensitive network traffic.
CVE-2006-2436 High 2006-05-17 No exploit published No public exploit WebSphere Application Server 5.0.2 (or any earlier cumulative fix) stores admin and LDAP passwords in plaintext in the FFDC logs when a login to WebSphere fails, which allows attackers to gain privileges.
CVE-2006-2435 Medium 2006-05-17 No exploit published No public exploit Unspecified vulnerability in IBM WebSphere Application Server 5.0.2 and earlier, and 5.1.1 and earlier, has unknown impact and attack vectors related to "Inserting certain script tags in urls [that] may allow unintended execution of scripts."
CVE-2006-2434 Medium 2006-05-17 No exploit published No public exploit Unspecified vulnerability in WebSphere 5.1.1 (or any earlier cumulative fix) Common Configuration Mode + CommonArchive and J2EE Models might allow attackers to obtain sensitive information via the trace.
CVE-2006-2433 High 2006-05-17 No exploit published No public exploit Unspecified vulnerability in IBM WebSphere Application Server 6.0.2, 6.0.2.1, 6.0.2.3, 6.0.2.5, and 6.0.2.7 has unknown impact and attack vectors related to the "administrative console".
CVE-2006-2431 Medium 2006-05-17 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7, allows remote attackers to inject arbitrary web script or HTML via the URI, which is contained in a FAULTACTOR element on this page. NOTE: some sources have reported the element as "faultfactor," but this is likely erroneous.
CVE-2006-2430 High 2006-05-17 No exploit published No public exploit IBM WebSphere Application Server 5.0.2 and earlier, 5.1.1 and earlier, and 6.0.2 up to 6.0.2.7 records user credentials in plaintext in addNode.log, which allows attackers to gain privileges.
CVE-2006-2429 High 2006-05-17 No exploit published No public exploit Unspecified vulnerability in IBM WebSphere Application Server 6.0.2, 6.0.2.1, 6.0.2.3, 6.0.2.5, and 6.0.2.7 has unknown impact and remote attack vectors related to "HTTP request handlers".
CVE-2006-2426 Medium 2006-05-17 Mitigation candidate Working exploit published Sun Java Runtime Environment (JRE) 1.5.0_6 and earlier, JDK 1.5.0_6 and earlier, and SDK 1.5.0_6 and earlier allows remote attackers to cause a denial of service (disk consumption) by using the Font.createFont function to create temporary files of arbitrary size in the %temp% directory.
CVE-2006-2342 High 2006-05-12 No exploit published No public exploit IBM WebSphere Application Server 6.0.2 before FixPack 3 allows remote attackers to bypass authentication for the Welcome Page via a request to the default context root.
CVE-2006-1886 High 2006-04-20 No exploit published No public exploit Unspecified vulnerability in the PeopleTools component in Oracle PeopleSoft Enterprise 8.46.12 and 8.47.04 has unknown impact and attack vectors, aka Vuln# PSE01.
CVE-2006-1885 High 2006-04-20 No exploit published No public exploit Multiple unspecified vulnerabilities in the Reporting Framework component in Oracle Enterprise Manager 9.0.1.5 and 9.2.0.7 have unknown impact and attack vectors, aka Vuln# (1) EM01 and (2) EM02.
CVE-2006-1884 High 2006-04-20 No exploit published No public exploit Unspecified vulnerability in the Oracle Thesaurus Management System component in Oracle E-Business Suite and OPA 4.5.2 Applications has unknown impact and attack vectors, aka Vuln# OPA01.
CVE-2006-1883 High 2006-04-20 No exploit published No public exploit Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite and Applications 11.5.10CU1 has unknown impact and attack vectors, aka Vuln# APPS05.
CVE-2006-1882 High 2006-04-20 No exploit published No public exploit Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10 have unknown impact and attack vectors, as identified by Vuln# (1) APPS03 in (a) iProcurement; (2) APPS04 in (b) Oracle Application Object Library; (3) APPS06, (4) APPS07, and (5) APPS08 in (c) Oracle Applications Technology Stack; and (6) APPS11 in (d) Oracle Order Capture.
CVE-2006-1881 High 2006-04-20 No exploit published No public exploit Unspecified vulnerability in the Financials for Asia/Pacific component in Oracle E-Business Suite and Applications 11.5.9 has unknown impact and attack vectors. component, aka Vuln# APPS02.
CVE-2006-1880 High 2006-04-20 No exploit published No public exploit Multiple unspecified vulnerabilities in Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, as identified by Vuln# (1) APPS01 in the (a) Application Install component; (2) APPS09 in the (b) Oracle Diagnostics Interfaces component; (3) APPS10 in the (c) Oracle General Ledger component; (4) APPS12 and (5) APPS13 in the (d) Oracle Receivables component.
CVE-2006-1619 Medium 2006-04-05 No exploit published No public exploit IBM WebSphere Application Server 4.0.1 through 4.0.3 allows remote attackers to cause a denial of service (application crash) via an HTTP request with a large header.