WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕Product jsp✕
Overview 6 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC
6matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC16.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 16.7% No exploit published 5 83.3%
Critical 0 0.0% High 0 0.0% Medium 6 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 6 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 16.7% Proof of concept only 0 0.0% Forecast only 5 83.3% No public exploit 0 0.0%
split by peak 4 / year
No exploit published: 5Mitigation candidate: 1 Medium: 6 not blocked: 6 Forecast only: 5Working exploit published: 1
20071 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20180 20190 20200 20210 20224 No exploit published4 Medium4 not blocked4 Forecast only4 20230 20241 No exploit published1 Medium1 not blocked1 Forecast only1
200820102012201420162018202020222024
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-27136 Medium 2024-06-24 No exploit published Forecast only XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later.
CVE-2022-28732 Medium 2022-08-04 No exploit published Forecast only A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later.
CVE-2022-28731 Medium 2022-08-04 No exploit published Forecast only A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page.
CVE-2022-28730 Medium 2022-08-04 No exploit published Forecast only A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later.
CVE-2022-27166 Medium 2022-08-04 No exploit published Forecast only A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.
CVE-2007-1355 Medium 2007-05-21 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.