Overview 208 matches · 92 protected · 73 exploited · 29 CISA KEV · 122 EPSS ≥ 0.5
Protected by Waratek
96
46.2%
Rule in development
1
0.5%
Mitigation candidate
111
53.4%
No exploit published
0
0.0%
blocked by ARMR today
92
44.2%
partly blocked
4
1.9%
not blocked
112
53.8%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
73
35.1%
Working exploit published
104
50.0%
Proof of concept only
31
14.9%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 22 / year
20002
Mitigation candidate2
Medium2
not blocked2
Working exploit published2
20011
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20026
Mitigation candidate6
High2
Medium4
not blocked6
Working exploit published6
20033
Protected by Waratek1
Mitigation candidate2
Medium3
blocked by ARMR today1
not blocked2
Working exploit published3
20040
20052
Protected by Waratek1
Mitigation candidate1
Medium2
blocked by ARMR today1
not blocked1
Working exploit published2
20062
Mitigation candidate2
Medium2
not blocked2
Working exploit published2
20077
Protected by Waratek1
Mitigation candidate6
Medium6
Low1
blocked by ARMR today1
not blocked6
Working exploit published7
20084
Protected by Waratek2
Mitigation candidate2
Medium4
blocked by ARMR today2
not blocked2
Working exploit published4
20098
Protected by Waratek2
Mitigation candidate6
High2
Medium6
blocked by ARMR today2
not blocked6
Working exploit published8
20106
Protected by Waratek1
Mitigation candidate5
Medium5
Low1
blocked by ARMR today1
not blocked5
Working exploit published6
20112
Mitigation candidate2
High1
Low1
not blocked2
Working exploit published2
20128
Protected by Waratek1
Mitigation candidate7
Critical1
Medium7
blocked by ARMR today1
not blocked7
Exploited1
Working exploit published7
20139
Protected by Waratek2
Mitigation candidate7
Critical1
High4
Medium4
blocked by ARMR today2
not blocked7
Exploited3
Working exploit published6
20145
Protected by Waratek2
Mitigation candidate3
High3
Medium2
blocked by ARMR today2
not blocked3
Exploited3
Working exploit published2
20152
Protected by Waratek2
Medium2
blocked by ARMR today2
Working exploit published2
201612
Protected by Waratek8
Mitigation candidate4
Critical4
High7
Medium1
blocked by ARMR today7
partly blocked1
not blocked4
Exploited3
Working exploit published8
Proof of concept only1
201710
Protected by Waratek10
Critical6
High4
blocked by ARMR today8
partly blocked2
Exploited7
Working exploit published3
20189
Protected by Waratek4
Mitigation candidate5
Critical1
High5
Medium3
blocked by ARMR today4
not blocked5
Exploited5
Working exploit published3
Proof of concept only1
201914
Protected by Waratek9
Mitigation candidate5
Critical6
High5
Medium3
blocked by ARMR today8
partly blocked1
not blocked5
Exploited6
Working exploit published4
Proof of concept only4
202022
Protected by Waratek11
Mitigation candidate11
Critical10
High8
Medium4
blocked by ARMR today11
not blocked11
Exploited9
Working exploit published6
Proof of concept only7
202116
Protected by Waratek11
Rule in development1
Mitigation candidate4
Critical11
High3
Medium2
blocked by ARMR today11
not blocked5
Exploited11
Working exploit published3
Proof of concept only2
202214
Protected by Waratek8
Mitigation candidate6
Critical9
High4
Medium1
blocked by ARMR today8
not blocked6
Exploited4
Working exploit published3
Proof of concept only7
202311
Protected by Waratek6
Mitigation candidate5
Critical5
High4
Medium2
blocked by ARMR today6
not blocked5
Exploited6
Working exploit published3
Proof of concept only2
202413
Protected by Waratek2
Mitigation candidate11
Critical6
High4
Medium2
Low1
blocked by ARMR today2
not blocked11
Exploited5
Working exploit published5
Proof of concept only3
202511
Protected by Waratek6
Mitigation candidate5
Critical5
High3
Medium3
blocked by ARMR today6
not blocked5
Exploited4
Working exploit published5
Proof of concept only2
20269
Protected by Waratek6
Mitigation candidate3
Critical3
High5
Medium1
blocked by ARMR today6
not blocked3
Exploited6
Working exploit published1
Proof of concept only2
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2002-2007 | Medium | 2002-12-31 | Mitigation candidate | Working exploit published | The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages. |
| CVE-2002-2006 | Medium | 2002-12-31 | Mitigation candidate | Working exploit published | The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets. |
| CVE-2002-1148 | Medium | 2002-10-11 | Mitigation candidate | Working exploit published | The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet. |
| CVE-2002-0936 | Medium | 2002-10-04 | Mitigation candidate | Working exploit published | The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null). |
| CVE-2002-0682 | High | 2002-07-23 | Mitigation candidate | Working exploit published | Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet. |
| CVE-2001-0590 | Medium | 2001-08-02 | Mitigation candidate | Working exploit published | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0). |
| CVE-2000-0760 | Medium | 2000-10-20 | Mitigation candidate | Working exploit published | The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension. |
| CVE-2000-0759 | Medium | 2000-10-20 | Mitigation candidate | Working exploit published | Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path. |