WaratekVRT Sign in
Reset
More filters (1)
Columns
Vendor oracle✕
Overview 111 matches · 0 protected · 21 exploited · 4 CISA KEV · 97 public PoC · 23 EPSS ≥ 0.5
111matches 0protected0.0% 21exploited18.9% 4CISA KEV3.6% 97public PoC87.4% 23EPSS ≥ 0.520.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 111 100.0% No exploit published 0 0.0%
Critical 20 18.0% High 33 29.7% Medium 47 42.3% Low 11 9.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 101 91.0% not established 10 9.0% unrecorded 0 0.0%
Exploited 21 18.9% Working exploit published 71 64.0% Proof of concept only 17 15.3% Forecast only 0 0.0% No public exploit 2 1.8%
split by peak 14 / year
Mitigation candidate: 111 Low: 11Medium: 47High: 33Critical: 20 not established: 10not blocked: 101 No public exploit: 2Proof of concept only: 17Working exploit published: 71Exploited: 21
20041 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20050 20060 20071 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20082 Mitigation candidate2 Medium2 not blocked2 Working exploit published2 20093 Mitigation candidate3 High1 Medium2 not blocked3 Working exploit published3 20103 Mitigation candidate3 Medium2 Low1 not blocked3 Working exploit published3 20115 Mitigation candidate5 High3 Medium1 Low1 not blocked5 Working exploit published5 201214 Mitigation candidate14 Critical1 High2 Medium7 Low4 not blocked12 not established2 Exploited3 Working exploit published11 20136 Mitigation candidate6 Medium5 Low1 not blocked5 not established1 Exploited1 Working exploit published5 20149 Mitigation candidate9 High1 Medium8 not blocked9 Working exploit published9 20155 Mitigation candidate5 High1 Low4 not blocked5 Working exploit published4 Proof of concept only1 20164 Mitigation candidate4 High1 Medium3 not blocked3 not established1 Exploited1 Working exploit published3 20178 Mitigation candidate8 Critical2 High3 Medium3 not blocked8 Working exploit published7 Proof of concept only1 20184 Mitigation candidate4 High2 Medium2 not blocked4 Working exploit published4 20198 Mitigation candidate8 High3 Medium5 not blocked7 not established1 Exploited3 Working exploit published5 202010 Mitigation candidate10 Critical6 High4 not blocked10 Exploited3 Working exploit published2 Proof of concept only4 No public exploit1 202113 Mitigation candidate13 Critical2 High6 Medium5 not blocked13 Exploited3 Working exploit published4 Proof of concept only6 20225 Mitigation candidate5 Critical3 High2 not blocked5 Exploited1 Working exploit published1 Proof of concept only3 20233 Mitigation candidate3 Critical1 High2 not blocked1 not established2 Exploited2 Working exploit published1 20241 Mitigation candidate1 High1 not blocked1 Proof of concept only1 20253 Mitigation candidate3 Critical3 not blocked1 not established2 Exploited3 20263 Mitigation candidate3 Critical2 High1 not blocked2 not established1 Exploited1 Proof of concept only1 No public exploit1
200420062008201020122014201620182020202220242026
111 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2010-3595 High 2011-01-19 Mitigation candidate Working exploit published Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality via unknown vectors related to Import Server. NOTE: the previous information was obtained from the January 2011 CPU. Oracle has not commented on claims from the original researcher that remote attackers can read arbitrary files via a full pathname in the first argument to the ImportBodyText method in the EasyMail ActiveX control (emsmtp.dll).
CVE-2010-3581 Low 2010-10-14 Mitigation candidate Working exploit published Unspecified vulnerability in the BPEL Console component in Oracle Fusion Middleware 11.1.1.1.0 and 11.1.1.2.0 allows remote authenticated users to affect integrity via unknown vectors.
CVE-2010-2375 Medium 2010-07-13 Mitigation candidate Working exploit published Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.
CVE-2010-2370 Medium 2010-07-13 Mitigation candidate Working exploit published Unspecified vulnerability in the Oracle Business Process Management component in Oracle Fusion Middleware 5.7 MP3, 6.0 MP5, and 10.3 MP2 allows remote attackers to affect integrity, related to BPM.
CVE-2009-1975 Medium 2009-07-14 Mitigation candidate Working exploit published Unspecified vulnerability in the WebLogic Server component in BEA Product Suite 10.3 allows remote attackers to affect confidentiality, integrity, and availability, related to the WLS Console Package.
CVE-2009-1553 Medium 2009-05-06 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in the Admin Console in Sun GlassFish Enterprise Server 2.1 allow remote attackers to inject arbitrary web script or HTML via the query string to (1) applications/applications.jsf, (2) configuration/configuration.jsf, (3) customMBeans/customMBeans.jsf, (4) resourceNode/resources.jsf, (5) sysnet/registration.jsf, or (6) webService/webServicesGeneral.jsf; or the name parameter to (7) configuration/auditModuleEdit.jsf, (8) configuration/httpListenerEdit.jsf, or (9) resourceNode/jdbcResourceEdit.jsf.
CVE-2008-5457 High 2009-01-14 Mitigation candidate Working exploit published Unspecified vulnerability in the Oracle BEA WebLogic Server Plugins for Apache, Sun and IIS web servers component in BEA Product Suite 10.3, 10.0 MP1, 9.2 MP3, 9.1, 9.0, 8.1 SP6, and 7.0 SP7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2008-5266 Medium 2008-11-28 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751.
CVE-2008-2751 Medium 2008-06-18 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, or (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (a) resourceNode/customResourceNew.jsf; the (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, or (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (b) resourceNode/externalResourceNew.jsf; the (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, or (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (c) resourceNode/jmsDestinationNew.jsf; the (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi or (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd parameter to (d) resourceNode/jmsConnectionNew.jsf; the (15) propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext or (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (e) resourceNode/jdbcResourceNew.jsf; the (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, or (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder parameter to (f) applications/lifecycleModulesNew.jsf; or the (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, or (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db parameter to (g) resourceNode/jdbcConnectionPoolNew1.jsf.
CVE-2007-0297 Medium 2007-01-17 Mitigation candidate Working exploit published Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.47.11 and 8.48.06 has unknown impact and attack vectors in PeopleTools, aka PSE03.
CVE-2004-2134 Medium 2004-01-28 Mitigation candidate Working exploit published Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords.
‹ prev page 2 of 2 next ›