Low Web CVEs
112 CVEs, 24 protected by Waratek
Overview 112 matches · 24 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
24
21.4%
Rule in development
0
0.0%
Mitigation candidate
2
1.8%
No exploit published
86
76.8%
blocked by ARMR today
24
21.4%
partly blocked
0
0.0%
not blocked
88
78.6%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
1.8%
Proof of concept only
3
2.7%
Forecast only
0
0.0%
No public exploit
107
95.5%
split by
peak 18 / year
20022
No exploit published2
Low2
not blocked2
No public exploit2
20035
No exploit published5
Low5
not blocked5
No public exploit5
20042
No exploit published2
Low2
not blocked2
No public exploit2
20052
No exploit published2
Low2
not blocked2
No public exploit2
20065
No exploit published5
Low5
not blocked5
No public exploit5
20072
No exploit published2
Low2
not blocked2
No public exploit2
20081
No exploit published1
Low1
not blocked1
No public exploit1
20098
No exploit published8
Low8
not blocked8
No public exploit8
20106
No exploit published6
Low6
not blocked6
No public exploit6
20114
Mitigation candidate1
No exploit published3
Low4
not blocked4
Working exploit published1
No public exploit3
20123
No exploit published3
Low3
not blocked3
No public exploit3
20139
No exploit published9
Low9
not blocked9
No public exploit9
20145
No exploit published5
Low5
not blocked5
No public exploit5
20150
20163
No exploit published3
Low3
not blocked3
No public exploit3
20174
Protected by Waratek1
No exploit published3
Low4
blocked by ARMR today1
not blocked3
No public exploit4
20180
20199
Protected by Waratek5
No exploit published4
Low9
blocked by ARMR today5
not blocked4
No public exploit9
202018
Protected by Waratek12
No exploit published6
Low18
blocked by ARMR today12
not blocked6
No public exploit18
20215
Protected by Waratek1
No exploit published4
Low5
blocked by ARMR today1
not blocked4
No public exploit5
20224
Protected by Waratek4
Low4
blocked by ARMR today4
No public exploit4
20230
20242
Mitigation candidate1
No exploit published1
Low2
not blocked2
Working exploit published1
No public exploit1
20255
No exploit published5
Low5
not blocked5
Proof of concept only1
No public exploit4
20268
Protected by Waratek1
No exploit published7
Low8
blocked by ARMR today1
not blocked7
Proof of concept only2
No public exploit6
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2006-0427 | Low | 2006-01-25 | No exploit published | No public exploit | Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted. |
| CVE-2005-4761 | Low | 2005-12-31 | No exploit published | No public exploit | BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used. |
| CVE-2005-4755 | Low | 2005-12-31 | No exploit published | No public exploit | BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys. |
| CVE-2004-2321 | Low | 2004-12-31 | No exploit published | No public exploit | BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword. |
| CVE-2004-0471 | Low | 2004-07-07 | No exploit published | No public exploit | BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown). |
| CVE-2003-1447 | Low | 2003-12-31 | No exploit published | No public exploit | IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML. |
| CVE-2003-1437 | Low | 2003-12-31 | No exploit published | No public exploit | BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access. |
| CVE-2003-1226 | Low | 2003-12-31 | No exploit published | No public exploit | BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords. |
| CVE-2003-1225 | Low | 2003-12-31 | No exploit published | No public exploit | The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords. |
| CVE-2003-1224 | Low | 2003-12-31 | No exploit published | No public exploit | Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen. |
| CVE-2002-2177 | Low | 2002-12-31 | No exploit published | No public exploit | BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users. |
| CVE-2002-1030 | Low | 2002-10-04 | No exploit published | No public exploit | Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections. |