WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕Oracle product: Oracle Database Server✕
Overview 5 matches · 1 protected · 2 exploited · 2 CISA KEV · 4 public PoC
5matches 1protected20.0% 2exploited40.0% 2CISA KEV40.0% 4public PoC80.0%
Protected by Waratek 2 40.0% Rule in development 0 0.0% Mitigation candidate 2 40.0% No exploit published 1 20.0%
Critical 1 20.0% High 4 80.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 20.0% partly blocked 1 20.0% not blocked 3 60.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 40.0% Working exploit published 2 40.0% Proof of concept only 0 0.0% Forecast only 1 20.0% No public exploit 0 0.0%
split by peak 2 / year
No exploit published: 1Mitigation candidate: 2Protected by Waratek: 2 High: 4Critical: 1 not blocked: 3partly blocked: 1blocked by ARMR today: 1 Forecast only: 1Working exploit published: 2Exploited: 2
20141 Mitigation candidate1 High1 not blocked1 Working exploit published1 20150 20160 20172 Protected by Waratek2 Critical1 High1 blocked by ARMR today1 partly blocked1 Exploited2 20180 20191 No exploit published1 High1 not blocked1 Forecast only1 20201 Mitigation candidate1 High1 not blocked1 Working exploit published1
2014201520162017201820192020
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-13935 High 2020-07-14 Mitigation candidate Working exploit published The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
CVE-2019-10072 High 2019-06-21 No exploit published Forecast only The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVE-2017-12617 High 2017-10-04 Protected by Waratek Exploited When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2016-8735 Critical 2017-04-06 Protected by Waratek Exploited Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
CVE-2014-0050 High 2014-04-01 Mitigation candidate Working exploit published MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.