WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product: WebSphere Application Server✕
Overview 11 matches · 8 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5
11matches 8in Waratek scope72.7% 1protected9.1% 0exploited0.0% 0CISA KEV0.0% 2EPSS ≥ 0.518.2%
Protected by Waratek 1 9.1% Rule in development 0 0.0% Mitigation candidate 7 63.6% No exploit published 0 0.0% Outside Waratek scope 3 27.3% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 1 9.1% High 2 18.2% Medium 8 72.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 9.1% partly blocked 0 0.0% not blocked 10 90.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 11 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Outside Waratek scope: 3Mitigation candidate: 7Protected by Waratek: 1 Medium: 8High: 2Critical: 1 not blocked: 10blocked by ARMR today: 1 Working exploit published: 11
20002 Mitigation candidate1 Outside Waratek scope1 High1 Medium1 not blocked2 Working exploit published2 20012 Mitigation candidate1 Outside Waratek scope1 Medium2 not blocked2 Working exploit published2 20020 20030 20040 20051 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20061 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20071 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20080 20091 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20101 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20111 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20120 20130 20140 20150 20160 20170 20180 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1
2001200320052007200920112013201520172019
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-4279 Critical 2019-05-17 Protected by Waratek Working exploit published IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.
CVE-2010-3271 Medium 2011-07-18 Mitigation candidate Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
CVE-2010-0425 High 2010-03-05 Outside Waratek scope Working exploit published modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
CVE-2009-0855 Medium 2009-03-09 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2007-5944 Medium 2007-11-14 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in Servlet Engine / Web Container in IBM WebSphere Application Server (WAS) 5.1.1.4 through 5.1.1.16 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header. NOTE: this might be the same issue as CVE-2006-3918, but there are insufficient details to be sure.
CVE-2006-2431 Medium 2006-05-17 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7, allows remote attackers to inject arbitrary web script or HTML via the URI, which is contained in a FAULTACTOR element on this page. NOTE: some sources have reported the element as "faultfactor," but this is likely erroneous.
CVE-2005-1112 Medium 2005-05-02 Mitigation candidate Working exploit published IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine.
CVE-2001-0390 Medium 2001-07-02 Mitigation candidate Working exploit published IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters.
CVE-2001-0122 Medium 2001-03-13 Outside Waratek scope Working exploit published Kernel leak in AfpaCache module of the Fast Response Cache Accelerator (FRCA) component of IBM HTTP Server 1.3.x and Websphere 3.52 allows remote attackers to cause a denial of service via a series of malformed HTTP requests that generate a "bad request" error.
CVE-2000-0848 High 2000-11-14 Outside Waratek scope Working exploit published Buffer overflow in IBM WebSphere web application server (WAS) allows remote attackers to execute arbitrary commands via a long Host: request header.
CVE-2000-0652 Medium 2000-07-24 Mitigation candidate Working exploit published IBM WebSphere allows remote attackers to read source code for executable web files by directly calling the default InvokerServlet using a URL which contains the "/servlet/file" string.