WaratekVRT Sign in
Reset
More filters (1)
Columns
Published to 2016-06-30✕
Overview 15 matches · 7 protected · 2 CISA KEV · 5 public PoC · 5 EPSS ≥ 0.5
15matches 7protected46.7% 2CISA KEV13.3% 5public PoC33.3% 5EPSS ≥ 0.533.3%
Protected by Waratek 7 46.7% Rule in development 0 0.0% Mitigation candidate 8 53.3% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 15 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 7 46.7% partly blocked 0 0.0% not blocked 5 33.3% not established 3 20.0% unrecorded 0 0.0%
Exploited 15 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 4 / year
Mitigation candidate: 8Protected by Waratek: 7 Medium: 15 not established: 3not blocked: 5blocked by ARMR today: 7 Exploited: 15
20081 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20090 20102 Protected by Waratek1 Mitigation candidate1 Medium2 blocked by ARMR today1 not blocked1 Exploited2 20110 20124 Protected by Waratek1 Mitigation candidate3 Medium4 blocked by ARMR today1 not blocked2 not established1 Exploited4 20133 Protected by Waratek2 Mitigation candidate1 Medium3 blocked by ARMR today2 not established1 Exploited3 20141 Mitigation candidate1 Medium1 not blocked1 Exploited1 20152 Protected by Waratek1 Mitigation candidate1 Medium2 blocked by ARMR today1 not blocked1 Exploited2 20162 Protected by Waratek1 Mitigation candidate1 Medium2 blocked by ARMR today1 not established1 Exploited2
200820092010201120122013201420152016
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2016-0545 Medium 2016-01-21 Mitigation candidate Exploited Unspecified vulnerability in the Oracle Customer Intelligence component in Oracle E-Business Suite 11.5.10.2, 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote attackers to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2016-0551, CVE-2016-0552, CVE-2016-0559, and CVE-2016-0560.
CVE-2016-0457 Medium 2016-01-21 Protected by Waratek Exploited Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0456. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/lcmServiceController.jsp.
CVE-2015-5188 Medium 2015-10-27 Mitigation candidate Exploited Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission.
CVE-2015-5531 Medium 2015-08-17 Protected by Waratek Exploited Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
CVE-2014-0094 Medium 2014-03-11 Mitigation candidate Exploited The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
CVE-2013-6397 Medium 2013-12-07 Protected by Waratek Exploited Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.
CVE-2013-3827 Medium 2013-10-16 Protected by Waratek Exploited Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.
CVE-2013-3821 Medium 2013-07-17 Mitigation candidate Exploited Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.51, 8.52, and 8.53 allows remote attackers to affect confidentiality and availability via unknown vectors related to Integration Broker.
CVE-2011-4085 Medium 2012-11-23 Mitigation candidate Exploited The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the GET and POST methods, which allow remote attackers to bypass authentication by sending a request with a different method. NOTE: this vulnerability exists because of a CVE-2010-0738 regression.
CVE-2011-2908 Medium 2012-11-23 Mitigation candidate Exploited Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that perform operations on MBeans and possibly execute arbitrary code via unspecified vectors.
CVE-2012-3153 Medium 2012-10-16 Protected by Waratek Exploited Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
CVE-2012-0518 Medium 2012-10-16 Mitigation candidate Exploited Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.
CVE-2010-2493 Medium 2010-08-10 Mitigation candidate Exploited The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the security_saml quickstart, (2) the webservice_proxy_security quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intended access restrictions via a crafted HTTP request.
CVE-2010-0738 Medium 2010-04-28 Protected by Waratek Exploited The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVE-2007-6672 Medium 2008-01-08 Protected by Waratek Exploited Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.