WaratekVRT Sign in
Reset
More filters (1)
Columns
Published to 2012-10-31✕
Overview 5 matches · 3 protected · 2 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
5matches 3protected60.0% 2CISA KEV40.0% 2public PoC40.0% 2EPSS ≥ 0.540.0%
Protected by Waratek 3 60.0% Rule in development 0 0.0% Mitigation candidate 2 40.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 5 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 60.0% partly blocked 0 0.0% not blocked 1 20.0% not established 1 20.0% unrecorded 0 0.0%
Exploited 5 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Mitigation candidate: 2Protected by Waratek: 3 Medium: 5 not established: 1not blocked: 1blocked by ARMR today: 3 Exploited: 5
Q1 081 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 Q2 080 Q3 080 Q4 080 Q1 090 Q2 090 Q3 090 Q4 090 Q1 100 Q2 101 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 Q3 101 Mitigation candidate1 Medium1 not blocked1 Exploited1 Q4 100 Q1 110 Q2 110 Q3 110 Q4 110 Q1 120 Q2 120 Q3 120 Q4 122 Protected by Waratek1 Mitigation candidate1 Medium2 blocked by ARMR today1 not established1 Exploited2
Q2 08Q4 08Q2 09Q4 09Q2 10Q4 10Q2 11Q4 11Q2 12Q4 12
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2012-3153 Medium 2012-10-16 Protected by Waratek Exploited Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
CVE-2012-0518 Medium 2012-10-16 Mitigation candidate Exploited Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.
CVE-2010-2493 Medium 2010-08-10 Mitigation candidate Exploited The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the security_saml quickstart, (2) the webservice_proxy_security quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intended access restrictions via a crafted HTTP request.
CVE-2010-0738 Medium 2010-04-28 Protected by Waratek Exploited The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVE-2007-6672 Medium 2008-01-08 Protected by Waratek Exploited Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.