WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2012-12-31✕Product http✕
Overview 10 matches · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
10matches 1protected10.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC10.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 10.0% Rule in development 0 0.0% Mitigation candidate 1 10.0% No exploit published 8 80.0%
Critical 0 0.0% High 4 40.0% Medium 5 50.0% Low 1 10.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 10.0% partly blocked 0 0.0% not blocked 9 90.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 10.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 9 90.0%
split by peak 3 / year
No exploit published: 8Mitigation candidate: 1Protected by Waratek: 1 Low: 1Medium: 5High: 4 not blocked: 9blocked by ARMR today: 1 No public exploit: 9Working exploit published: 1
20021 Mitigation candidate1 High1 not blocked1 Working exploit published1 20030 20042 No exploit published2 Medium1 Low1 not blocked2 No public exploit2 20050 20061 No exploit published1 High1 not blocked1 No public exploit1 20072 No exploit published2 High1 Medium1 not blocked2 No public exploit2 20080 20090 20100 20111 No exploit published1 Medium1 not blocked1 No public exploit1 20123 Protected by Waratek1 No exploit published2 High1 Medium2 blocked by ARMR today1 not blocked2 No public exploit3
20022003200420052006200720082009201020112012
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2012-5955 High 2012-12-20 No exploit published No public exploit Unspecified vulnerability in the IBM HTTP Server component 5.3 in IBM WebSphere Application Server (WAS) for z/OS allows remote attackers to execute arbitrary commands via unknown vectors.
CVE-2012-5785 Medium 2012-11-04 No exploit published No public exploit Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5783 Medium 2012-11-04 Protected by Waratek No public exploit Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2011-1498 Medium 2011-07-07 No exploit published No public exploit Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
CVE-2006-6969 Medium 2007-02-07 No exploit published No public exploit Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
CVE-2007-0279 High 2007-01-17 No exploit published No public exploit Multiple unspecified vulnerabilities in Oracle HTTP Server 9.2.0.8 and Oracle E-Business Suite and Applications 11.5.10CU2 have unknown impact and attack vectors, aka (1) OHS01, (2) OHS02, (3) OHS05, (4) OHS06, and (5) OHS07.
CVE-2006-5350 High 2006-10-18 No exploit published No public exploit Unspecified vulnerability in Oracle HTTP Server 9.2.0.7 and Oracle E-Business Suite and Applications 11.5.10CU2 has unknown impact and local attack vectors, aka Vuln# OHS08.
CVE-2004-2381 Medium 2004-12-31 No exploit published No public exploit HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length.
CVE-2004-1877 Low 2004-03-30 No exploit published No public exploit The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password.
CVE-2002-2272 High 2002-12-31 Mitigation candidate Working exploit published Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.