WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product application server✕
Overview 4 matches · 3 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC
4matches 3in Waratek scope75.0% 1protected25.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 1 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 50.0% Outside Waratek scope 0 0.0% Not applicable 1 25.0% Withdrawn CVE 0 0.0%
Critical 1 25.0% High 0 0.0% Medium 2 50.0% Low 1 25.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 25.0% partly blocked 0 0.0% not blocked 3 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 4 100.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 1No exploit published: 2Protected by Waratek: 1 Low: 1Medium: 2Critical: 1 not blocked: 3blocked by ARMR today: 1 Forecast only: 4
20011 Not applicable1 Medium1 not blocked1 Forecast only1 20022 No exploit published2 Medium1 Low1 not blocked2 Forecast only2 20030 20040 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20181 Protected by Waratek1 Critical1 blocked by ARMR today1 Forecast only1
200220042006200820102012201420162018
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2018-1275 Critical 2018-04-11 Protected by Waratek Forecast only Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
CVE-2002-0568 Low 2002-07-03 No exploit published Forecast only Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.
CVE-2002-0563 Medium 2002-07-03 No exploit published Forecast only The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.
CVE-2001-1217 Medium 2001-12-21 Not applicable Forecast only Directory traversal vulnerability in PL/SQL Apache module in Oracle Oracle 9i Application Server allows remote attackers to access sensitive information via a double encoded URL with .. (dot dot) sequences.