WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2016-10-31✕Product api✕
Overview 17 matches · 1 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
17matches 1protected5.9% 0exploited0.0% 0CISA KEV0.0% 2public PoC11.8% 1EPSS ≥ 0.55.9%
Protected by Waratek 1 5.9% Rule in development 0 0.0% Mitigation candidate 2 11.8% No exploit published 14 82.4%
Critical 0 0.0% High 1 5.9% Medium 15 88.2% Low 1 5.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 5.9% partly blocked 0 0.0% not blocked 16 94.1% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 11.8% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 15 88.2%
split by peak 7 / year
No exploit published: 14Mitigation candidate: 2Protected by Waratek: 1 Low: 1Medium: 15High: 1 not blocked: 16blocked by ARMR today: 1 No public exploit: 15Working exploit published: 2
20011 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20020 20030 20040 20050 20060 20071 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20081 No exploit published1 Medium1 not blocked1 No public exploit1 20090 20100 20110 20121 No exploit published1 High1 not blocked1 No public exploit1 20134 Protected by Waratek1 No exploit published3 Medium3 Low1 blocked by ARMR today1 not blocked3 No public exploit4 20141 No exploit published1 Medium1 not blocked1 No public exploit1 20151 No exploit published1 Medium1 not blocked1 No public exploit1 20167 No exploit published7 Medium7 not blocked7 No public exploit7
20022004200620082010201220142016
17 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2016-8295 Medium 2016-10-25 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors.
CVE-2016-8292 Medium 2016-10-25 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Talent Acquisition Manager.
CVE-2016-8285 Medium 2016-10-25 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote administrators to affect confidentiality and integrity via vectors related to Candidate Gateway.
CVE-2016-3460 Medium 2016-04-21 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to ePerformance.
CVE-2016-3457 Medium 2016-04-21 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise HCM ePerformance component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Security.
CVE-2016-0407 Medium 2016-04-21 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Fusion HR Talent Integration.
CVE-2016-0570 Medium 2016-01-21 No exploit published No public exploit Unspecified vulnerability in the Oracle HCM Configuration Workbench component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors.
CVE-2015-2944 Medium 2015-06-02 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse.
CVE-2014-5075 Medium 2014-10-25 No exploit published No public exploit The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2013-2254 Medium 2013-10-17 No exploit published No public exploit The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors.
CVE-2013-5960 Medium 2013-09-30 No exploit published No public exploit The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.
CVE-2013-5679 Low 2013-09-30 Protected by Waratek No public exploit The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.
CVE-2013-1624 Medium 2013-02-08 No exploit published No public exploit The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169.
CVE-2012-5817 High 2012-11-04 No exploit published No public exploit Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2008-1285 Medium 2008-03-11 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2007-1355 Medium 2007-05-21 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.
CVE-2001-0590 Medium 2001-08-02 Mitigation candidate Working exploit published Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).