WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product: WebSphere Application Server✕Has a public PoC✕
Overview 14 matches · 11 in Waratek scope · 3 protected · 1 exploited · 1 CISA KEV · 3 EPSS ≥ 0.5
14matches 11in Waratek scope78.6% 3protected21.4% 1exploited7.1% 1CISA KEV7.1% 3EPSS ≥ 0.521.4%
Protected by Waratek 3 21.4% Rule in development 0 0.0% Mitigation candidate 8 57.1% No exploit published 0 0.0% Outside Waratek scope 3 21.4% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 2 14.3% High 4 28.6% Medium 8 57.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 21.4% partly blocked 0 0.0% not blocked 11 78.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 7.1% Working exploit published 11 78.6% Proof of concept only 2 14.3% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Outside Waratek scope: 3Mitigation candidate: 8Protected by Waratek: 3 Medium: 8High: 4Critical: 2 not blocked: 11blocked by ARMR today: 3 Proof of concept only: 2Working exploit published: 11Exploited: 1
20002 Mitigation candidate1 Outside Waratek scope1 High1 Medium1 not blocked2 Working exploit published2 20012 Mitigation candidate1 Outside Waratek scope1 Medium2 not blocked2 Working exploit published2 20020 20030 20040 20051 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20061 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20071 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20080 20091 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20101 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20111 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20120 20130 20140 20150 20161 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20170 20180 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20202 Protected by Waratek1 Mitigation candidate1 High2 blocked by ARMR today1 not blocked1 Proof of concept only2
20002002200420062008201020122014201620182020
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-4464 High 2020-07-17 Protected by Waratek Proof of concept only IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489.
CVE-2020-4276 High 2020-03-26 Mitigation candidate Proof of concept only IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. X-Force ID: 175984.
CVE-2019-4279 Critical 2019-05-17 Protected by Waratek Working exploit published IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.
CVE-2015-7450 Critical 2016-01-02 Protected by Waratek Exploited Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons Collections library.
CVE-2010-3271 Medium 2011-07-18 Mitigation candidate Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
CVE-2010-0425 High 2010-03-05 Outside Waratek scope Working exploit published modules/arch/win32/mod_isapi.c in mod_isapi in the Apache HTTP Server 2.0.37 through 2.0.63, 2.2.0 through 2.2.14, and 2.3.x before 2.3.7, when running on Windows, does not ensure that request processing is complete before calling isapi_unload for an ISAPI .dll module, which allows remote attackers to execute arbitrary code via unspecified vectors related to a crafted request, a reset packet, and "orphaned callback pointers."
CVE-2009-0855 Medium 2009-03-09 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2007-5944 Medium 2007-11-14 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in Servlet Engine / Web Container in IBM WebSphere Application Server (WAS) 5.1.1.4 through 5.1.1.16 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header. NOTE: this might be the same issue as CVE-2006-3918, but there are insufficient details to be sure.
CVE-2006-2431 Medium 2006-05-17 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7, allows remote attackers to inject arbitrary web script or HTML via the URI, which is contained in a FAULTACTOR element on this page. NOTE: some sources have reported the element as "faultfactor," but this is likely erroneous.
CVE-2005-1112 Medium 2005-05-02 Mitigation candidate Working exploit published IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine.
CVE-2001-0390 Medium 2001-07-02 Mitigation candidate Working exploit published IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters.
CVE-2001-0122 Medium 2001-03-13 Outside Waratek scope Working exploit published Kernel leak in AfpaCache module of the Fast Response Cache Accelerator (FRCA) component of IBM HTTP Server 1.3.x and Websphere 3.52 allows remote attackers to cause a denial of service via a series of malformed HTTP requests that generate a "bad request" error.
CVE-2000-0848 High 2000-11-14 Outside Waratek scope Working exploit published Buffer overflow in IBM WebSphere web application server (WAS) allows remote attackers to execute arbitrary commands via a long Host: request header.
CVE-2000-0652 Medium 2000-07-24 Mitigation candidate Working exploit published IBM WebSphere allows remote attackers to read source code for executable web files by directly calling the default InvokerServlet using a URL which contains the "/servlet/file" string.