WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product knowledge✕
Overview 21 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
21matches 1in Waratek scope4.8% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.54.8%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 4.8% No exploit published 0 0.0% Outside Waratek scope 1 4.8% Not applicable 19 90.5% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 10 47.6% Medium 11 52.4% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 21 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 21 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 7 / year
Not applicable: 19Outside Waratek scope: 1Mitigation candidate: 1 Medium: 11High: 10 not blocked: 21 Working exploit published: 21
20031 Not applicable1 High1 not blocked1 Working exploit published1 20040 20054 Not applicable4 High3 Medium1 not blocked4 Working exploit published4 20063 Not applicable3 High1 Medium2 not blocked3 Working exploit published3 20072 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20087 Not applicable7 High3 Medium4 not blocked7 Working exploit published7 20091 Not applicable1 Medium1 not blocked1 Working exploit published1 20100 20110 20121 Not applicable1 Medium1 not blocked1 Working exploit published1 20130 20140 20150 20161 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20170 20180 20191 Outside Waratek scope1 High1 not blocked1 Working exploit published1
200320052007200920112013201520172019
21 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-0227 High 2019-05-01 Outside Waratek scope Working exploit published A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
CVE-2016-3542 Medium 2016-07-21 Mitigation candidate Working exploit published Unspecified vulnerability in the Oracle Knowledge Management component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote administrators to affect confidentiality and integrity via unknown vectors.
CVE-2012-0988 Medium 2012-09-20 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in config/dmsDefaults.php in KnowledgeTree 3.7.0.2 and possibly earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) login.php, (2) admin.php, or (3) preferences.php.
CVE-2009-4192 Medium 2009-12-03 Not applicable Working exploit published Directory traversal vulnerability in dialog/file_manager.php in Interspire Knowledge Manager 5 allows remote attackers to read arbitrary files via a .. (dot dot) in the p parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2008-5264 Medium 2008-11-28 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in searcher.exe in Tornado Knowledge Retrieval System 4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the p parameter in a root action.
CVE-2008-5088 High 2008-11-14 Not applicable Working exploit published Multiple SQL injection vulnerabilities in PHPKB Knowledge Base Software 1.5 Professional allow remote attackers to execute arbitrary SQL commands via the ID parameter to (1) email.php and (2) question.php, a different vector than CVE-2008-1909.
CVE-2008-3555 Medium 2008-08-08 Not applicable Working exploit published Directory traversal vulnerability in index.php in (1) WSN Forum 4.1.43 and earlier, (2) Gallery 4.1.30 and earlier, (3) Knowledge Base (WSNKB) 4.1.36 and earlier, (4) Links 4.1.44 and earlier, and possibly (5) Classifieds before 4.1.30 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the TID parameter, as demonstrated by uploading a .jpg file containing PHP sequences.
CVE-2008-3100 Medium 2008-07-29 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in lib/owl.lib.php in Steve Bourgeois and Chris Vincent Owl Intranet Knowledgebase 0.95 and earlier allows remote attackers to inject arbitrary web script or HTML via the username parameter in a getpasswd action to register.php.
CVE-2008-1909 High 2008-04-22 Not applicable Working exploit published SQL injection vulnerability in comment.php in PHP Knowledge Base (PHPKB) 1.5 and 2.0 allows remote attackers to execute arbitrary SQL commands via the ID parameter.
CVE-2008-1727 High 2008-04-11 Not applicable Working exploit published KnowledgeQuest 2.5 and 2.6 does not require authentication for access to admincheck.php, which allows remote attackers to create arbitrary admin accounts.
CVE-2008-1726 Medium 2008-04-11 Not applicable Working exploit published Multiple SQL injection vulnerabilities in KnowledgeQuest 2.6, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the (1) kqid parameter to (a) articletext.php and (b) articletextonly.php and the (2) username parameter to (c) logincheck.php.
CVE-2007-6574 Medium 2007-12-28 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the origin parameter to work/work.php in a display_upload_form action, or the forum parameter to (2) forum/viewforum.php or (3) forum/viewthread.php.
CVE-2007-2889 High 2007-05-30 Not applicable Working exploit published SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the scormcontopen parameter.
CVE-2006-5919 High 2006-11-15 Not applicable Working exploit published PHP remote file inclusion vulnerability in admin/e_data/visEdit_control.class.php in ActiveCampaign KnowledgeBuilder 2.2 allows remote attackers to execute arbitrary PHP code via a URL in the visEdit_root parameter, a different vector than CVE-2003-1131.
CVE-2006-4844 Medium 2006-09-19 Not applicable Working exploit published PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter.
CVE-2006-2285 Medium 2006-05-10 Not applicable Working exploit published PHP remote file inclusion vulnerability in authldap.php in Dokeos 1.6.4 allows remote attackers to execute arbitrary PHP code via a URL in the includePath parameter.
CVE-2005-4047 Medium 2005-12-07 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in kb.asp in IISWorks ASPKnowledgeBase 2.0 allows remote attackers to inject arbitrary web script or HTML via the a parameter.
CVE-2005-3942 High 2005-12-01 Not applicable Working exploit published SQL injection vulnerability in knowledgebase-control.php in Orca Knowledgebase 2.1b and earlier allows remote attackers to execute arbitrary SQL commands via the qid parameter.
CVE-2005-3939 High 2005-12-01 Not applicable Working exploit published Multiple SQL injection vulnerabilities in WSN Knowledge Base 1.2.0 and earler allow remote attackers to execute arbitrary SQL commands via the (1) catid, (2) perpage, (3) ascdesc, and (4) orderlinks in a displaycat action in (a) index.php; and the (5) id parameter in (b) comments.php and (c) memberlist.php.
CVE-2005-3882 High 2005-11-29 Not applicable Working exploit published SQL injection vulnerability in answer.php in FAQSystems FAQRing Knowledge Base Software 3.0 and earlier allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2003-1131 High 2003-12-31 Not applicable Working exploit published PHP remote file inclusion vulnerability in index.php in KnowledgeBuilder, referred to as KnowledgeBase, allows remote attackers to execute arbitrary PHP code by modifying the page parameter to reference a URL on a remote web server that contains the code.