WaratekVRT Sign in
Reset
More filters (1)
Columns
Published to 2005-03-31✕
Overview 12 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
12matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC8.3% 1EPSS ≥ 0.58.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 8.3% No exploit published 11 91.7%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 12 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 12 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 8.3% Proof of concept only 0 0.0% Forecast only 1 8.3% No public exploit 10 83.3%
split by peak 6 / quarter
No exploit published: 11Mitigation candidate: 1 Low: 12 not blocked: 12 No public exploit: 10Forecast only: 1Working exploit published: 1
Q3 021 No exploit published1 Low1 not blocked1 Forecast only1 Q4 022 No exploit published2 Low2 not blocked2 No public exploit2 Q1 030 Q2 030 Q3 030 Q4 036 Mitigation candidate1 No exploit published5 Low6 not blocked6 Working exploit published1 No public exploit5 Q1 041 No exploit published1 Low1 not blocked1 No public exploit1 Q2 040 Q3 041 No exploit published1 Low1 not blocked1 No public exploit1 Q4 041 No exploit published1 Low1 not blocked1 No public exploit1
Q3 02Q4 02Q1 03Q2 03Q3 03Q4 03Q1 04Q2 04Q3 04Q4 04
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2004-2321 Low 2004-12-31 No exploit published No public exploit BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword.
CVE-2004-0471 Low 2004-07-07 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown).
CVE-2004-1877 Low 2004-03-30 No exploit published No public exploit The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password.
CVE-2003-1447 Low 2003-12-31 No exploit published No public exploit IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML.
CVE-2003-1437 Low 2003-12-31 No exploit published No public exploit BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access.
CVE-2003-1226 Low 2003-12-31 No exploit published No public exploit BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.
CVE-2003-1225 Low 2003-12-31 No exploit published No public exploit The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.
CVE-2003-1224 Low 2003-12-31 No exploit published No public exploit Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.
CVE-2003-1134 Low 2003-12-31 Mitigation candidate Working exploit published Sun Java 1.3.1, 1.4.1, and 1.4.2 allows local users to cause a denial of service (JVM crash), possibly by calling the ClassDepth function with a null parameter, which causes a crash instead of generating a null pointer exception.
CVE-2002-2177 Low 2002-12-31 No exploit published No public exploit BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
CVE-2002-1030 Low 2002-10-04 No exploit published No public exploit Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections.
CVE-2002-0568 Low 2002-07-03 No exploit published Forecast only Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.