WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product fuse✕
Overview 134 matches · 72 in Waratek scope · 18 protected · 6 exploited · 4 CISA KEV · 23 public PoC · 8 EPSS ≥ 0.5
split by peak 19 / year
Not applicable: 59Outside Waratek scope: 3No exploit published: 51Mitigation candidate: 1Protected by Waratek: 20 Low: 12Medium: 53High: 51Critical: 18 not blocked: 114partly blocked: 2blocked by ARMR today: 18 No public exploit: 104Proof of concept only: 8Working exploit published: 16Exploited: 6
19991 Not applicable1 High1 not blocked1 Working exploit published1 20000 20012 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 20025 Not applicable5 High1 Medium4 not blocked5 Working exploit published2 No public exploit3 20030 20043 Not applicable3 Medium3 not blocked3 Working exploit published1 No public exploit2 20055 Not applicable5 Medium3 Low2 not blocked5 Working exploit published2 No public exploit3 20061 Not applicable1 Medium1 not blocked1 No public exploit1 20075 Not applicable5 High3 Medium2 not blocked5 Working exploit published2 No public exploit3 20082 Not applicable2 High1 Medium1 not blocked2 Working exploit published1 No public exploit1 20090 20101 Not applicable1 Low1 not blocked1 No public exploit1 20115 Not applicable5 High1 Medium1 Low3 not blocked5 Working exploit published2 No public exploit3 20121 Not applicable1 Medium1 not blocked1 Working exploit published1 20132 No exploit published2 Medium2 not blocked2 No public exploit2 20143 No exploit published3 Medium2 Low1 not blocked3 No public exploit3 20155 Protected by Waratek1 No exploit published3 Not applicable1 Critical1 Medium3 Low1 blocked by ARMR today1 not blocked4 Exploited1 Working exploit published1 No public exploit3 20164 Protected by Waratek1 Not applicable3 Critical1 High3 partly blocked1 not blocked3 Exploited1 No public exploit3 20176 Protected by Waratek3 No exploit published3 Critical3 High3 blocked by ARMR today2 partly blocked1 not blocked3 Exploited2 Working exploit published1 No public exploit3 201811 Protected by Waratek3 No exploit published4 Not applicable4 Critical2 High6 Medium3 blocked by ARMR today3 not blocked8 Working exploit published1 Proof of concept only1 No public exploit9 20199 Protected by Waratek3 No exploit published2 Outside Waratek scope1 Not applicable3 Critical1 High3 Medium4 Low1 blocked by ARMR today3 not blocked6 No public exploit9 202015 Protected by Waratek2 No exploit published11 Outside Waratek scope2 Critical2 High7 Medium6 blocked by ARMR today2 not blocked13 No public exploit15 20219 Protected by Waratek2 No exploit published7 High3 Medium4 Low2 blocked by ARMR today2 not blocked7 Exploited1 No public exploit8 20227 Protected by Waratek1 No exploit published4 Not applicable2 Critical1 High3 Medium3 blocked by ARMR today1 not blocked6 Proof of concept only1 No public exploit6 20233 Mitigation candidate1 No exploit published2 High3 not blocked3 Exploited1 No public exploit2 20243 No exploit published2 Not applicable1 High2 Medium1 not blocked3 No public exploit3 20257 Protected by Waratek1 No exploit published1 Not applicable5 High3 Medium3 Low1 blocked by ARMR today1 not blocked6 Proof of concept only2 No public exploit5 202619 Protected by Waratek3 No exploit published7 Not applicable9 Critical7 High8 Medium4 blocked by ARMR today3 not blocked16 Proof of concept only4 No public exploit15
1999200220052008201120142017202020232026
134 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2014-0085 Low 2014-04-17 No exploit published No public exploit JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.
CVE-2013-4372 Medium 2013-09-30 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page.
CVE-2012-5575 Medium 2013-08-19 No exploit published No public exploit Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."
CVE-2012-5295 Medium 2012-10-04 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in login.cfm in FuseTalk Forums 3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the windowed parameter.
CVE-2010-5033 High 2011-11-02 Not applicable Working exploit published SQL injection vulnerability in ProductList.cfm in Fusebox 5.5.1 allows remote attackers to execute arbitrary SQL commands via the CatDisplay parameter.
CVE-2011-0543 Low 2011-09-02 Not applicable No public exploit Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access restrictions and unmount arbitrary directories via a symlink attack.
CVE-2011-0542 Low 2011-09-02 Not applicable No public exploit fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a mount or umount, which allows local users to unmount arbitrary directories via unspecified vectors.
CVE-2011-0541 Low 2011-09-02 Not applicable No public exploit fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack.
CVE-2010-3879 Medium 2011-01-22 Not applicable Working exploit published FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789.
CVE-2010-0789 Low 2010-03-02 Not applicable No public exploit fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint.
CVE-2008-2232 Medium 2008-07-17 Not applicable No public exploit The expand_template function in afuse.c in afuse 0.2 allows local users to gain privileges via shell metacharacters in a pathname.
CVE-2008-2284 High 2008-05-18 Not applicable Working exploit published PHP remote file inclusion vulnerability in fusebox5.php in Fusebox 5.5.1 allows remote attackers to execute arbitrary PHP code via a URL in the FUSEBOX_APPLICATION_PATH parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2007-5280 Medium 2007-10-09 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in messages.jsp in AppFuse before 2.0 Final allow remote attackers to inject arbitrary web script or HTML via unspecified input that is recorded in (1) success or (2) error messages.
CVE-2007-3705 High 2007-07-11 Not applicable No public exploit SQL injection vulnerability in FuseTalk 2.0 allows remote attackers to execute arbitrary SQL commands via the FTVAR_SUBCAT (txForumID) parameter to forum/index.cfm and possibly other unspecified components, related to forum/include/error/forumerror.cfm.
CVE-2007-3339 Medium 2007-06-21 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the (1) FTVAR_LINKP and (2) FTVAR_URLP parameters to (a) forum/include/error/autherror.cfm, and the (3) FTVAR_SCRIPTRUN parameter to (b) forum/include/common/comfinish.cfm and (c) blog/include/common/comfinish.cfm.
CVE-2007-3301 High 2007-06-20 Not applicable Working exploit published SQL injection vulnerability in forum/include/error/autherror.cfm in FuseTalk allows remote attackers to execute arbitrary SQL commands via the errorcode parameter. NOTE: a patch may have been released privately between April and June 2007. NOTE: this issue may overlap CVE-2007-3273.
CVE-2007-3273 High 2007-06-19 Not applicable No public exploit SQL injection vulnerability in index.cfm in FuseTalk 2.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2006-0242 Medium 2006-01-18 Not applicable No public exploit Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter.
CVE-2005-3971 Medium 2005-12-03 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field.
CVE-2005-3531 Low 2005-11-23 Not applicable No public exploit fusermount in FUSE before 2.4.1, if installed setuid root, allows local users to corrupt /etc/mtab and possibly modify mount options by performing a mount over a directory whose name contains certain special characters.
CVE-2005-2481 Medium 2005-08-05 Not applicable No public exploit ColdFusion Fusebox 4.1.0 allows remote attackers to obtain sensitive information via an invalid fuseaction parameter, which leaks the full server path in an error message, as demonstrated using the "?" (question mark) character.
CVE-2005-2480 Medium 2005-08-05 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm.
CVE-2005-1858 Low 2005-06-03 Not applicable Working exploit published FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.
CVE-2004-1995 Medium 2004-12-31 Not applicable Working exploit published Cross-Site Request Forgery (CSRF) vulnerability in FuseTalk 2.0 allows remote attackers to create arbitrary accounts via a link to adduser.cfm.
CVE-2004-1594 Medium 2004-10-13 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in FuseTalk 4.0 allows remote attackers to execute arbitrary web script via an img src tag.
CVE-2004-1994 Medium 2004-05-05 Not applicable No public exploit FuseTalk 4.0 allows remote attackers to ban other users via a direct request to banning.cfm.
CVE-2002-2166 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in FuseTalk 2.0 and 3.0 allows remote attackers to insert arbitrary HTML and web script.
CVE-2002-0504 High 2002-08-12 Not applicable Working exploit published Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote attackers to execute script in other clients via the NFuse_Application parameter to (1) launch.jsp or (2) launch.asp.
CVE-2002-0503 Medium 2002-08-12 Not applicable No public exploit Directory traversal vulnerability in boilerplate.asp for Citrix NFuse 1.5 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the NFuse_Template parameter.
CVE-2002-0502 Medium 2002-08-12 Not applicable Working exploit published Citrix NFuse 1.6 may allow remote attackers to list applications without authentication by accessing the applist.asp page.
CVE-2002-0301 Medium 2002-05-31 Not applicable No public exploit Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSE_USER and NFUSE_PASSWORD parameters.
CVE-2001-0848 Medium 2001-12-06 Not applicable No public exploit join.cfm in e-Zone Media Fuse Talk allows a local user to execute arbitrary SQL code via a semi-colon (;) in a form variable.
CVE-2001-0760 Medium 2001-10-18 Not applicable Working exploit published Citrix Nfuse 1.51 allows remote attackers to obtain the absolute path of the web root via a malformed request to launch.asp that does not provide the session field.
CVE-1999-0759 High 1999-09-13 Not applicable Working exploit published Buffer overflow in FuseMAIL POP service via long USER and PASS commands.
‹ prev page 2 of 2 next ›