WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor bea✕
Overview 12 matches · 7 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
12matches 7in Waratek scope58.3% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 3EPSS ≥ 0.525.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 7 58.3% No exploit published 0 0.0% Outside Waratek scope 4 33.3% Not applicable 1 8.3% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 5 41.7% Medium 7 58.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 12 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 12 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 1Outside Waratek scope: 4Mitigation candidate: 7 Medium: 7High: 5 not blocked: 12 Working exploit published: 12
20003 Mitigation candidate3 High2 Medium1 not blocked3 Working exploit published3 20011 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20021 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20032 Mitigation candidate1 Outside Waratek scope1 Medium2 not blocked2 Working exploit published2 20041 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20051 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20060 20071 Not applicable1 Medium1 not blocked1 Working exploit published1 20081 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20090 20101 Mitigation candidate1 Medium1 not blocked1 Working exploit published1
20002001200220032004200520062007200820092010
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2010-2375 Medium 2010-07-13 Mitigation candidate Working exploit published Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
CVE-2008-3257 High 2008-07-22 Outside Waratek scope Working exploit published Stack-based buffer overflow in the Apache Connector (mod_wl) in Oracle WebLogic Server (formerly BEA WebLogic Server) 10.3 and earlier allows remote attackers to execute arbitrary code via a long HTTP version string, as demonstrated by a string after "POST /.jsp" in an HTTP request.
CVE-2007-6198 Medium 2007-12-01 Not applicable Working exploit published portal/server.pt in the Plumtree portal in BEA AquaLogic Interaction 5.0.2 through 5.0.4 and 6.0.1.218452 allows wildcards in advanced searches for usernames, which allows remote attackers to enumerate valid usernames via the in_tx_fulltext parameter.
CVE-2005-1380 Medium 2005-05-03 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action.
CVE-2004-0204 High 2004-08-06 Outside Waratek scope Working exploit published Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
CVE-2003-0624 Medium 2003-12-01 Outside Waratek scope Working exploit published Cross-site scripting (XSS) vulnerability in InteractiveQuery.jsp for BEA WebLogic 8.1 and earlier allows remote attackers to inject malicious web script via the person parameter.
CVE-2003-0621 Medium 2003-12-01 Mitigation candidate Working exploit published The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument.
CVE-2002-0106 Medium 2002-03-25 Mitigation candidate Working exploit published BEA Systems Weblogic Server 6.1 allows remote attackers to cause a denial of service via a series of requests to .JSP files that contain an MS-DOS device name.
CVE-2001-0098 High 2001-02-12 Outside Waratek scope Working exploit published Buffer overflow in Bea WebLogic Server before 5.1.0 allows remote attackers to execute arbitrary commands via a long URL that begins with a ".." string.
CVE-2000-0685 High 2000-10-20 Mitigation candidate Working exploit published BEA WebLogic 5.1.x does not properly restrict access to the PageCompileServlet, which could allow remote attackers to compile and execute Java JHTML code by directly invoking the servlet on any source file.
CVE-2000-0684 High 2000-10-20 Mitigation candidate Working exploit published BEA WebLogic 5.1.x does not properly restrict access to the JSPServlet, which could allow remote attackers to compile and execute Java JSP code by directly invoking the servlet on any source file.
CVE-2000-0500 Medium 2000-06-21 Mitigation candidate Working exploit published The default configuration of BEA WebLogic 5.1.0 allows a remote attacker to view source code of programs by requesting a URL beginning with /file/, which causes the default servlet to display the file without further processing.