Overview 5 matches · 3 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
5matches
3in Waratek scope60.0%
1protected20.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
20.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
40.0%
Outside Waratek scope
0
0.0%
Not applicable
2
40.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
20.0%
partly blocked
0
0.0%
not blocked
4
80.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
5
100.0%
split by
peak 3 / year
20061
Not applicable1
Medium1
not blocked1
No public exploit1
20070
20080
20090
20100
20110
20120
20130
20140
20150
20163
No exploit published2
Not applicable1
High1
Medium2
not blocked3
No public exploit3
20170
20180
20190
20200
20210
20221
Protected by Waratek1
Critical1
blocked by ARMR today1
No public exploit1
200620082010201220142016201820202022
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2022-32533 | Critical | 2022-07-06 | Protected by Waratek | No public exploit | Apache Jetspeed-2 does not sufficiently filter untrusted user input by default leading to a number of issues including XSS, CSRF, XXE, and SSRF. Setting the configuration option "xss.filter.post = true" may mitigate these issues. NOTE: Apache Jetspeed is a dormant project of Apache Portals and no updates will be provided for this issue |
| CVE-2016-2171 | High | 2016-04-11 | Not applicable | No public exploit | The User Manager service in Apache Jetspeed before 2.3.1 does not properly restrict access using Jetspeed Security, which allows remote attackers to (1) add, (2) edit, or (3) delete users via the REST API. |
| CVE-2016-0712 | Medium | 2016-04-11 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in Apache Jetspeed before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to portal. |
| CVE-2016-0711 | Medium | 2016-04-11 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a (1) link, (2) page, or (3) folder resource. |
| CVE-2006-0248 | Medium | 2006-01-18 | Not applicable | No public exploit | Virata-EmWeb web server 6_1_0, as used in (1) Intracom JetSpeed 500 and 520 and (2) Allied Data Technologies CopperJet 811 RouterPlus, allows remote attackers to access privileged information, such as user lists and configuration settings, via direct HTTP requests. |