WaratekVRT Sign in

Low Web CVEs

112 CVEs, 24 protected by Waratek

Reset
More filters (1)
Columns
Product web✕
Overview 112 matches · 24 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
112matches 24protected21.4% 0exploited0.0% 0CISA KEV0.0% 2public PoC1.8% 0EPSS ≥ 0.50.0%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 112 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 24 21.4% partly blocked 0 0.0% not blocked 88 78.6% not established 0 0.0% unrecorded 0 0.0%
split by peak 18 / year
No exploit published: 86Mitigation candidate: 2Protected by Waratek: 24 Low: 112 not blocked: 88blocked by ARMR today: 24 No public exploit: 107Proof of concept only: 3Working exploit published: 2
20022 No exploit published2 Low2 not blocked2 No public exploit2 20035 No exploit published5 Low5 not blocked5 No public exploit5 20042 No exploit published2 Low2 not blocked2 No public exploit2 20052 No exploit published2 Low2 not blocked2 No public exploit2 20065 No exploit published5 Low5 not blocked5 No public exploit5 20072 No exploit published2 Low2 not blocked2 No public exploit2 20081 No exploit published1 Low1 not blocked1 No public exploit1 20098 No exploit published8 Low8 not blocked8 No public exploit8 20106 No exploit published6 Low6 not blocked6 No public exploit6 20114 Mitigation candidate1 No exploit published3 Low4 not blocked4 Working exploit published1 No public exploit3 20123 No exploit published3 Low3 not blocked3 No public exploit3 20139 No exploit published9 Low9 not blocked9 No public exploit9 20145 No exploit published5 Low5 not blocked5 No public exploit5 20150 20163 No exploit published3 Low3 not blocked3 No public exploit3 20174 Protected by Waratek1 No exploit published3 Low4 blocked by ARMR today1 not blocked3 No public exploit4 20180 20199 Protected by Waratek5 No exploit published4 Low9 blocked by ARMR today5 not blocked4 No public exploit9 202018 Protected by Waratek12 No exploit published6 Low18 blocked by ARMR today12 not blocked6 No public exploit18 20215 Protected by Waratek1 No exploit published4 Low5 blocked by ARMR today1 not blocked4 No public exploit5 20224 Protected by Waratek4 Low4 blocked by ARMR today4 No public exploit4 20230 20242 Mitigation candidate1 No exploit published1 Low2 not blocked2 Working exploit published1 No public exploit1 20255 No exploit published5 Low5 not blocked5 Proof of concept only1 No public exploit4 20268 Protected by Waratek1 No exploit published7 Low8 blocked by ARMR today1 not blocked7 Proof of concept only2 No public exploit6
2002200420062008201020122014201620182020202220242026
112 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2006-0427 Low 2006-01-25 No exploit published No public exploit Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.
CVE-2005-4761 Low 2005-12-31 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used.
CVE-2005-4755 Low 2005-12-31 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys.
CVE-2004-2321 Low 2004-12-31 No exploit published No public exploit BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword.
CVE-2004-0471 Low 2004-07-07 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown).
CVE-2003-1447 Low 2003-12-31 No exploit published No public exploit IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML.
CVE-2003-1437 Low 2003-12-31 No exploit published No public exploit BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access.
CVE-2003-1226 Low 2003-12-31 No exploit published No public exploit BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.
CVE-2003-1225 Low 2003-12-31 No exploit published No public exploit The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.
CVE-2003-1224 Low 2003-12-31 No exploit published No public exploit Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.
CVE-2002-2177 Low 2002-12-31 No exploit published No public exploit BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
CVE-2002-1030 Low 2002-10-04 No exploit published No public exploit Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections.
‹ prev page 2 of 2 next ›