WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product: WebLogic Server✕
Overview 15 matches · 11 in Waratek scope · 4 protected · 0 exploited · 0 CISA KEV · 7 EPSS ≥ 0.5
15matches 11in Waratek scope73.3% 4protected26.7% 0exploited0.0% 0CISA KEV0.0% 7EPSS ≥ 0.546.7%
Protected by Waratek 4 26.7% Rule in development 0 0.0% Mitigation candidate 7 46.7% No exploit published 0 0.0% Outside Waratek scope 4 26.7% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 4 26.7% High 5 33.3% Medium 6 40.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 26.7% partly blocked 0 0.0% not blocked 11 73.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 15 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Outside Waratek scope: 4Mitigation candidate: 7Protected by Waratek: 4 Medium: 6High: 5Critical: 4 not blocked: 11blocked by ARMR today: 4 Working exploit published: 15
20003 Mitigation candidate3 High2 Medium1 not blocked3 Working exploit published3 20011 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20021 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20032 Mitigation candidate1 Outside Waratek scope1 Medium2 not blocked2 Working exploit published2 20041 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20051 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20060 20070 20081 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20090 20101 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20110 20120 20130 20140 20150 20161 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20172 Protected by Waratek2 Critical2 blocked by ARMR today2 Working exploit published2 20181 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1
2000200220042006200820102012201420162018
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2018-3245 Critical 2018-10-17 Protected by Waratek Working exploit published Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2017-3248 Critical 2017-01-27 Protected by Waratek Working exploit published Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).
CVE-2016-3510 Critical 2016-07-21 Protected by Waratek Working exploit published Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.
CVE-2010-2375 Medium 2010-07-13 Mitigation candidate Working exploit published Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
CVE-2008-3257 High 2008-07-22 Outside Waratek scope Working exploit published Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
CVE-2005-1380 Medium 2005-05-03 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action.
CVE-2004-0204 High 2004-08-06 Outside Waratek scope Working exploit published Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
CVE-2003-0624 Medium 2003-12-01 Outside Waratek scope Working exploit published Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter.
CVE-2003-0621 Medium 2003-12-01 Mitigation candidate Working exploit published The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument.
CVE-2002-0106 Medium 2002-03-25 Mitigation candidate Working exploit published BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name.
CVE-2001-0098 High 2001-02-12 Outside Waratek scope Working exploit published Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a ".." string.
CVE-2000-0685 High 2000-10-20 Mitigation candidate Working exploit published BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file.
CVE-2000-0684 High 2000-10-20 Mitigation candidate Working exploit published BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.
CVE-2000-0500 Medium 2000-06-21 Mitigation candidate Working exploit published The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing.