Overview 134 matches · 72 in Waratek scope · 18 protected · 6 exploited · 4 CISA KEV · 23 public PoC · 8 EPSS ≥ 0.5
134matches
72in Waratek scope53.7%
18protected13.4%
6exploited4.5%
4CISA KEV3.0%
23public PoC17.2%
8EPSS ≥ 0.56.0%
Protected by Waratek
20
14.9%
Rule in development
0
0.0%
Mitigation candidate
1
0.7%
No exploit published
51
38.1%
Outside Waratek scope
3
2.2%
Not applicable
59
44.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
18
13.4%
partly blocked
2
1.5%
not blocked
114
85.1%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 19 / year
19991
Not applicable1
High1
not blocked1
Working exploit published1
20000
20012
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20025
Not applicable5
High1
Medium4
not blocked5
Working exploit published2
No public exploit3
20030
20043
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20055
Not applicable5
Medium3
Low2
not blocked5
Working exploit published2
No public exploit3
20061
Not applicable1
Medium1
not blocked1
No public exploit1
20075
Not applicable5
High3
Medium2
not blocked5
Working exploit published2
No public exploit3
20082
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
20090
20101
Not applicable1
Low1
not blocked1
No public exploit1
20115
Not applicable5
High1
Medium1
Low3
not blocked5
Working exploit published2
No public exploit3
20121
Not applicable1
Medium1
not blocked1
Working exploit published1
20132
No exploit published2
Medium2
not blocked2
No public exploit2
20143
No exploit published3
Medium2
Low1
not blocked3
No public exploit3
20155
Protected by Waratek1
No exploit published3
Not applicable1
Critical1
Medium3
Low1
blocked by ARMR today1
not blocked4
Exploited1
Working exploit published1
No public exploit3
20164
Protected by Waratek1
Not applicable3
Critical1
High3
partly blocked1
not blocked3
Exploited1
No public exploit3
20176
Protected by Waratek3
No exploit published3
Critical3
High3
blocked by ARMR today2
partly blocked1
not blocked3
Exploited2
Working exploit published1
No public exploit3
201811
Protected by Waratek3
No exploit published4
Not applicable4
Critical2
High6
Medium3
blocked by ARMR today3
not blocked8
Working exploit published1
Proof of concept only1
No public exploit9
20199
Protected by Waratek3
No exploit published2
Outside Waratek scope1
Not applicable3
Critical1
High3
Medium4
Low1
blocked by ARMR today3
not blocked6
No public exploit9
202015
Protected by Waratek2
No exploit published11
Outside Waratek scope2
Critical2
High7
Medium6
blocked by ARMR today2
not blocked13
No public exploit15
20219
Protected by Waratek2
No exploit published7
High3
Medium4
Low2
blocked by ARMR today2
not blocked7
Exploited1
No public exploit8
20227
Protected by Waratek1
No exploit published4
Not applicable2
Critical1
High3
Medium3
blocked by ARMR today1
not blocked6
Proof of concept only1
No public exploit6
20233
Mitigation candidate1
No exploit published2
High3
not blocked3
Exploited1
No public exploit2
20243
No exploit published2
Not applicable1
High2
Medium1
not blocked3
No public exploit3
20257
Protected by Waratek1
No exploit published1
Not applicable5
High3
Medium3
Low1
blocked by ARMR today1
not blocked6
Proof of concept only2
No public exploit5
202619
Protected by Waratek3
No exploit published7
Not applicable9
Critical7
High8
Medium4
blocked by ARMR today3
not blocked16
Proof of concept only4
No public exploit15
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2014-0085 | Low | 2014-04-17 | No exploit published | No public exploit | JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log. |
| CVE-2013-4372 | Medium | 2013-09-30 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote attackers to inject arbitrary web script or HTML via the (1) user field in the create user page or (2) profile version to the create profile page. |
| CVE-2012-5575 | Medium | 2013-08-19 | No exploit published | No public exploit | Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack." |
| CVE-2012-5295 | Medium | 2012-10-04 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in login.cfm in FuseTalk Forums 3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the windowed parameter. |
| CVE-2010-5033 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in ProductList.cfm in Fusebox 5.5.1 allows remote attackers to execute arbitrary SQL commands via the CatDisplay parameter. |
| CVE-2011-0543 | Low | 2011-09-02 | Not applicable | No public exploit | Certain legacy functionality in fusermount in fuse 2.8.5 and earlier, when util-linux does not support the --no-canonicalize option, allows local users to bypass intended access restrictions and unmount arbitrary directories via a symlink attack. |
| CVE-2011-0542 | Low | 2011-09-02 | Not applicable | No public exploit | fusermount in fuse 2.8.5 and earlier does not perform a chdir to / before performing a mount or umount, which allows local users to unmount arbitrary directories via unspecified vectors. |
| CVE-2011-0541 | Low | 2011-09-02 | Not applicable | No public exploit | fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack. |
| CVE-2010-3879 | Medium | 2011-01-22 | Not applicable | Working exploit published | FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789. |
| CVE-2010-0789 | Low | 2010-03-02 | Not applicable | No public exploit | fusermount in FUSE before 2.7.5, and 2.8.x before 2.8.2, allows local users to unmount an arbitrary FUSE filesystem share via a symlink attack on a mountpoint. |
| CVE-2008-2232 | Medium | 2008-07-17 | Not applicable | No public exploit | The expand_template function in afuse.c in afuse 0.2 allows local users to gain privileges via shell metacharacters in a pathname. |
| CVE-2008-2284 | High | 2008-05-18 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in fusebox5.php in Fusebox 5.5.1 allows remote attackers to execute arbitrary PHP code via a URL in the FUSEBOX_APPLICATION_PATH parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2007-5280 | Medium | 2007-10-09 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in messages.jsp in AppFuse before 2.0 Final allow remote attackers to inject arbitrary web script or HTML via unspecified input that is recorded in (1) success or (2) error messages. |
| CVE-2007-3705 | High | 2007-07-11 | Not applicable | No public exploit | SQL injection vulnerability in FuseTalk 2.0 allows remote attackers to execute arbitrary SQL commands via the FTVAR_SUBCAT (txForumID) parameter to forum/index.cfm and possibly other unspecified components, related to forum/include/error/forumerror.cfm. |
| CVE-2007-3339 | Medium | 2007-06-21 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the (1) FTVAR_LINKP and (2) FTVAR_URLP parameters to (a) forum/include/error/autherror.cfm, and the (3) FTVAR_SCRIPTRUN parameter to (b) forum/include/common/comfinish.cfm and (c) blog/include/common/comfinish.cfm. |
| CVE-2007-3301 | High | 2007-06-20 | Not applicable | Working exploit published | SQL injection vulnerability in forum/include/error/autherror.cfm in FuseTalk allows remote attackers to execute arbitrary SQL commands via the errorcode parameter. NOTE: a patch may have been released privately between April and June 2007. NOTE: this issue may overlap CVE-2007-3273. |
| CVE-2007-3273 | High | 2007-06-19 | Not applicable | No public exploit | SQL injection vulnerability in index.cfm in FuseTalk 2.0 allows remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2006-0242 | Medium | 2006-01-18 | Not applicable | No public exploit | Cross-site scripting vulnerability in index.php in PHP Fusebox 4.0.6 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter. |
| CVE-2005-3971 | Medium | 2005-12-03 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the login form in Citrix MetaFrame Secure Access Manager 2.0 through 2.2 and NFuse Elite 1.0 allows remote attackers to inject arbitrary web script or HTML via the username field. |
| CVE-2005-3531 | Low | 2005-11-23 | Not applicable | No public exploit | fusermount in FUSE before 2.4.1, if installed setuid root, allows local users to corrupt /etc/mtab and possibly modify mount options by performing a mount over a directory whose name contains certain special characters. |
| CVE-2005-2481 | Medium | 2005-08-05 | Not applicable | No public exploit | ColdFusion Fusebox 4.1.0 allows remote attackers to obtain sensitive information via an invalid fuseaction parameter, which leaks the full server path in an error message, as demonstrated using the "?" (question mark) character. |
| CVE-2005-2480 | Medium | 2005-08-05 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm. |
| CVE-2005-1858 | Low | 2005-06-03 | Not applicable | Working exploit published | FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information. |
| CVE-2004-1995 | Medium | 2004-12-31 | Not applicable | Working exploit published | Cross-Site Request Forgery (CSRF) vulnerability in FuseTalk 2.0 allows remote attackers to create arbitrary accounts via a link to adduser.cfm. |
| CVE-2004-1594 | Medium | 2004-10-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in FuseTalk 4.0 allows remote attackers to execute arbitrary web script via an img src tag. |
| CVE-2004-1994 | Medium | 2004-05-05 | Not applicable | No public exploit | FuseTalk 4.0 allows remote attackers to ban other users via a direct request to banning.cfm. |
| CVE-2002-2166 | Medium | 2002-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in FuseTalk 2.0 and 3.0 allows remote attackers to insert arbitrary HTML and web script. |
| CVE-2002-0504 | High | 2002-08-12 | Not applicable | Working exploit published | Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote attackers to execute script in other clients via the NFuse_Application parameter to (1) launch.jsp or (2) launch.asp. |
| CVE-2002-0503 | Medium | 2002-08-12 | Not applicable | No public exploit | Directory traversal vulnerability in boilerplate.asp for Citrix NFuse 1.5 allows remote authenticated users to read arbitrary files via a .. (dot dot) in the NFuse_Template parameter. |
| CVE-2002-0502 | Medium | 2002-08-12 | Not applicable | Working exploit published | Citrix NFuse 1.6 may allow remote attackers to list applications without authentication by accessing the applist.asp page. |
| CVE-2002-0301 | Medium | 2002-05-31 | Not applicable | No public exploit | Citrix NFuse 1.6 allows remote attackers to bypass authentication and obtain sensitive information by directly calling launch.asp with invalid NFUSE_USER and NFUSE_PASSWORD parameters. |
| CVE-2001-0848 | Medium | 2001-12-06 | Not applicable | No public exploit | join.cfm in e-Zone Media Fuse Talk allows a local user to execute arbitrary SQL code via a semi-colon (;) in a form variable. |
| CVE-2001-0760 | Medium | 2001-10-18 | Not applicable | Working exploit published | Citrix Nfuse 1.51 allows remote attackers to obtain the absolute path of the web root via a malformed request to launch.asp that does not provide the session field. |
| CVE-1999-0759 | High | 1999-09-13 | Not applicable | Working exploit published | Buffer overflow in FuseMAIL POP service via long USER and PASS commands. |