WaratekVRT Sign in

Low Server CVEs

119 CVEs, 17 protected by Waratek

Reset
More filters (1)
Columns
Product server✕
Overview 119 matches · 17 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
119matches 17protected14.3% 0exploited0.0% 0CISA KEV0.0% 1public PoC0.8% 1EPSS ≥ 0.50.8%
Protected by Waratek 17 14.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 102 85.7%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 119 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 17 14.3% partly blocked 0 0.0% not blocked 102 85.7% not established 0 0.0% unrecorded 0 0.0%
split by peak 11 / year
No exploit published: 102Protected by Waratek: 17 Low: 119 not blocked: 102blocked by ARMR today: 17 No public exploit: 116Forecast only: 1Proof of concept only: 1Working exploit published: 1
20023 No exploit published3 Low3 not blocked3 Forecast only1 No public exploit2 20035 No exploit published5 Low5 not blocked5 No public exploit5 20043 No exploit published3 Low3 not blocked3 No public exploit3 20053 No exploit published3 Low3 not blocked3 No public exploit3 20069 No exploit published9 Low9 not blocked9 No public exploit9 20072 No exploit published2 Low2 not blocked2 No public exploit2 20082 No exploit published2 Low2 not blocked2 No public exploit2 200910 Protected by Waratek1 No exploit published9 Low10 blocked by ARMR today1 not blocked9 Working exploit published1 No public exploit9 20105 No exploit published5 Low5 not blocked5 No public exploit5 20113 No exploit published3 Low3 not blocked3 No public exploit3 20127 No exploit published7 Low7 not blocked7 No public exploit7 20137 No exploit published7 Low7 not blocked7 No public exploit7 20147 No exploit published7 Low7 not blocked7 No public exploit7 20151 No exploit published1 Low1 not blocked1 No public exploit1 20168 No exploit published8 Low8 not blocked8 No public exploit8 20177 Protected by Waratek3 No exploit published4 Low7 blocked by ARMR today3 not blocked4 No public exploit7 20183 Protected by Waratek3 Low3 blocked by ARMR today3 No public exploit3 201911 Protected by Waratek6 No exploit published5 Low11 blocked by ARMR today6 not blocked5 No public exploit11 20207 Protected by Waratek3 No exploit published4 Low7 blocked by ARMR today3 not blocked4 No public exploit7 20215 No exploit published5 Low5 not blocked5 No public exploit5 20222 No exploit published2 Low2 not blocked2 No public exploit2 20232 Protected by Waratek1 No exploit published1 Low2 blocked by ARMR today1 not blocked1 Proof of concept only1 No public exploit1 20242 No exploit published2 Low2 not blocked2 No public exploit2 20252 No exploit published2 Low2 not blocked2 No public exploit2 20263 No exploit published3 Low3 not blocked3 No public exploit3
2002200420062008201020122014201620182020202220242026
119 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2006-2466 Low 2006-05-19 No exploit published No public exploit BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a "timing window" when a compilation error occurs, aka the "JSP showcode vulnerability."
CVE-2006-0432 Low 2006-01-25 No exploit published No public exploit Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources.
CVE-2006-0431 Low 2006-01-25 No exploit published No public exploit Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors.
CVE-2006-0429 Low 2006-01-25 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions.
CVE-2006-0427 Low 2006-01-25 No exploit published No public exploit Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.
CVE-2005-4761 Low 2005-12-31 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used.
CVE-2005-4755 Low 2005-12-31 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys.
CVE-2005-3164 Low 2005-10-06 No exploit published No public exploit The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
CVE-2004-2321 Low 2004-12-31 No exploit published No public exploit BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword.
CVE-2004-0471 Low 2004-07-07 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown).
CVE-2004-1877 Low 2004-03-30 No exploit published No public exploit The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password.
CVE-2003-1447 Low 2003-12-31 No exploit published No public exploit IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML.
CVE-2003-1437 Low 2003-12-31 No exploit published No public exploit BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access.
CVE-2003-1226 Low 2003-12-31 No exploit published No public exploit BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.
CVE-2003-1225 Low 2003-12-31 No exploit published No public exploit The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.
CVE-2003-1224 Low 2003-12-31 No exploit published No public exploit Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.
CVE-2002-2177 Low 2002-12-31 No exploit published No public exploit BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
CVE-2002-1030 Low 2002-10-04 No exploit published No public exploit Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections.
CVE-2002-0568 Low 2002-07-03 No exploit published Forecast only Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.
‹ prev page 2 of 2 next ›