WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2011-01-01✕Product application server✕
Overview 6 matches · 3 protected · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
6matches 3protected50.0% 0exploited0.0% 0CISA KEV0.0% 3EPSS ≥ 0.550.0%
Protected by Waratek 3 50.0% Rule in development 0 0.0% Mitigation candidate 3 50.0% No exploit published 0 0.0%
Critical 2 33.3% High 2 33.3% Medium 2 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 50.0% partly blocked 0 0.0% not blocked 3 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 6 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Mitigation candidate: 3Protected by Waratek: 3 Medium: 2High: 2Critical: 2 not blocked: 3blocked by ARMR today: 3 Working exploit published: 6
20112 Mitigation candidate2 High1 Medium1 not blocked2 Working exploit published2 20120 20130 20140 20150 20161 Mitigation candidate1 High1 not blocked1 Working exploit published1 20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20181 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1
201120122013201420152016201720182019
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-4279 Critical 2019-05-17 Protected by Waratek Working exploit published IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.
CVE-2018-1271 Medium 2018-04-06 Protected by Waratek Working exploit published Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2016-0793 High 2016-04-01 Mitigation candidate Working exploit published Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
CVE-2010-3271 Medium 2011-07-18 Mitigation candidate Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.
CVE-2011-0807 High 2011-04-20 Mitigation candidate Working exploit published Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration.