WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product access manager✕
Overview 13 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
13matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.57.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 7.7% Not applicable 12 92.3% Withdrawn CVE 0 0.0%
Critical 4 30.8% High 3 23.1% Medium 6 46.2% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 13 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 13 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 12Outside Waratek scope: 1 Medium: 6High: 3Critical: 4 not blocked: 13 Working exploit published: 13
20001 Not applicable1 High1 not blocked1 Working exploit published1 20010 20020 20030 20040 20050 20061 Not applicable1 Medium1 not blocked1 Working exploit published1 20071 Not applicable1 Medium1 not blocked1 Working exploit published1 20080 20091 Not applicable1 Medium1 not blocked1 Working exploit published1 20101 Not applicable1 Medium1 not blocked1 Working exploit published1 20111 Not applicable1 High1 not blocked1 Working exploit published1 20120 20130 20142 Not applicable2 Medium2 not blocked2 Working exploit published2 20151 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20160 20170 20183 Not applicable3 Critical3 not blocked3 Working exploit published3 20191 Not applicable1 Critical1 not blocked1 Working exploit published1
2001200320052007200920112013201520172019
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-6716 Critical 2019-03-21 Not applicable Working exploit published An unauthenticated Insecure Direct Object Reference (IDOR) in Wicket Core in LogonBox Nervepoint Access Manager 2013 through 2017 allows a remote attacker to enumerate internal Active Directory usernames and group names, and alter back-end server jobs (backup and synchronization jobs), which could allow for the possibility of a Denial of Service attack via a modified jobId parameter in a runJob.html GET request.
CVE-2018-9022 Critical 2018-06-18 Not applicable Working exploit published An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file.
CVE-2018-9021 Critical 2018-06-18 Not applicable Working exploit published An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests.
CVE-2015-4664 Critical 2018-06-18 Not applicable Working exploit published An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands.
CVE-2015-0235 High 2015-01-28 Outside Waratek scope Working exploit published Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
CVE-2014-9412 Medium 2014-12-23 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to roma/jsp/debug/debug.jsp or (2) an arbitrary parameter in a debug.DumpAll action to nps/servlet/webacc, a different issue than CVE-2014-5216.
CVE-2014-5216 Medium 2014-12-23 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in a dev.Empty action to nps/servlet/webacc, (2) the error parameter to nidp/jsp/x509err.jsp, (3) the lang parameter to sslvpn/applet_agent.jsp, or (4) the secureLoggingServersA parameter to roma/system/cntl, a different issue than CVE-2014-9412.
CVE-2011-4162 High 2011-12-05 Not applicable Working exploit published The (1) AddUser, (2) AddUserEx, (3) RemoveUser, (4) RemoveUserByGuide, (5) RemoveUserEx, and (6) RemoveUserRegardless methods in HP Protect Tools Device Access Manager (PTDAM) before 6.1.0.1 allow remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a long SidString argument.
CVE-2010-4120 Medium 2010-10-28 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in the TAM console in IBM Tivoli Access Manager for e-business 6.1.0 before 6.1.0-TIV-TAM-FP0006 allow remote attackers to inject arbitrary web script or HTML via (1) the parm1 parameter to ivt/ivtserver, or the method parameter to (2) acl, (3) domain, (4) group, (5) gso, (6) gsogroup, (7) os, (8) pop, (9) rule, (10) user, or (11) webseal in ibm/wpm/.
CVE-2009-0348 Medium 2009-01-29 Not applicable Working exploit published The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
CVE-2007-0110 Medium 2007-01-09 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in nidp/idff/sso in Novell Access Manager Identity Server before 3.0.0-1013 allows remote attackers to inject arbitrary web script or HTML via the IssueInstant parameter, which is not properly handled in the resulting error message.
CVE-2006-0513 Medium 2006-02-06 Not applicable Working exploit published Directory traversal vulnerability in pkmslogout in Tivoli Web Server Plug-in 5.1.0.10 in Tivoli Access Manager (TAM) 5.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
CVE-2000-0516 High 2000-06-06 Not applicable Working exploit published When configured to store configuration information in an LDAP directory, Shiva Access Manager 5.0.0 stores the root DN (Distinguished Name) name and password in cleartext in a file that is world readable, which allows local users to compromise the LDAP server.