Overview 216 matches · 0 protected · 3 exploited · 1 CISA KEV · 11 public PoC · 5 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
1
0.5%
Mitigation candidate
10
4.6%
No exploit published
205
94.9%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
216
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 46 / year
20011
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20020
20030
20040
20050
20060
20071
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
20081
No exploit published1
Medium1
not blocked1
No public exploit1
20090
20100
20110
20121
No exploit published1
High1
not blocked1
No public exploit1
20133
No exploit published3
Medium3
not blocked3
No public exploit3
20141
No exploit published1
Medium1
not blocked1
No public exploit1
20151
No exploit published1
Medium1
not blocked1
No public exploit1
20167
No exploit published7
Medium7
not blocked7
No public exploit7
20175
No exploit published5
High2
Medium3
not blocked5
No public exploit5
201815
No exploit published15
Critical1
High3
Medium11
not blocked15
No public exploit15
201919
No exploit published19
Critical5
High7
Medium7
not blocked19
No public exploit19
202019
Mitigation candidate1
No exploit published18
Critical4
High2
Medium12
Low1
not blocked19
Proof of concept only1
No public exploit18
202118
No exploit published18
Critical1
High7
Medium8
Low2
not blocked18
No public exploit18
20228
No exploit published8
Critical1
High1
Medium6
not blocked8
Proof of concept only2
No public exploit6
202325
Mitigation candidate4
No exploit published21
Critical4
High8
Medium13
not blocked25
Exploited1
Working exploit published3
Proof of concept only5
No public exploit16
20245
Mitigation candidate1
No exploit published4
Critical3
High1
Low1
not blocked5
Working exploit published1
Forecast only1
No public exploit3
202540
Rule in development1
Mitigation candidate2
No exploit published37
Critical3
High11
Medium24
Low2
not blocked40
Exploited2
Working exploit published1
Proof of concept only3
No public exploit34
202646
No exploit published46
Critical8
High17
Medium20
Low1
not blocked46
Proof of concept only3
No public exploit43
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2016-8295 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors. |
| CVE-2016-8292 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Talent Acquisition Manager. |
| CVE-2016-8285 | Medium | 2016-10-25 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote administrators to affect confidentiality and integrity via vectors related to Candidate Gateway. |
| CVE-2016-3460 | Medium | 2016-04-21 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to ePerformance. |
| CVE-2016-3457 | Medium | 2016-04-21 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise HCM ePerformance component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality and integrity via vectors related to Security. |
| CVE-2016-0407 | Medium | 2016-04-21 | No exploit published | No public exploit | Unspecified vulnerability in the PeopleSoft Enterprise HCM component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via vectors related to Fusion HR Talent Integration. |
| CVE-2016-0570 | Medium | 2016-01-21 | No exploit published | No public exploit | Unspecified vulnerability in the Oracle HCM Configuration Workbench component in Oracle E-Business Suite 12.1.1, 12.1.2, and 12.1.3 allows remote attackers to affect confidentiality via unknown vectors. |
| CVE-2015-2944 | Medium | 2015-06-02 | No exploit published | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Apache Sling API before 2.2.2 and Apache Sling Servlets Post before 2.1.2 allow remote attackers to inject arbitrary web script or HTML via the URI, related to (1) org/apache/sling/api/servlets/HtmlResponse and (2) org/apache/sling/servlets/post/HtmlResponse. |
| CVE-2014-5075 | Medium | 2014-10-25 | No exploit published | No public exploit | The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. |
| CVE-2013-2254 | Medium | 2013-10-17 | No exploit published | No public exploit | The deepGetOrCreateNode function in impl/operations/AbstractCreateOperation.java in org.apache.sling.servlets.post.bundle 2.2.0 and 2.3.0 in Apache Sling does not properly handle a NULL value that returned when the session does not have permissions to the root node, which allows remote attackers to cause a denial of service (infinite loop) via unspecified vectors. |
| CVE-2013-5960 | Medium | 2013-09-30 | No exploit published | No public exploit | The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679. |
| CVE-2013-1624 | Medium | 2013-02-08 | No exploit published | No public exploit | The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malformed CBC padding, which allows remote attackers to conduct distinguishing attacks and plaintext-recovery attacks via statistical analysis of timing data for crafted packets, a related issue to CVE-2013-0169. |
| CVE-2012-5817 | High | 2012-11-04 | No exploit published | No public exploit | Codehaus XFire 1.2.6 and earlier, as used in the Amazon EC2 API Tools Java library and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. |
| CVE-2008-1285 | Medium | 2008-03-11 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in Sun Java Server Faces (JSF) 1.2 before 1.2_08 allows remote attackers to inject arbitrary web script or HTML via unknown vectors. |
| CVE-2007-1355 | Medium | 2007-05-21 | Mitigation candidate | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors. |
| CVE-2001-0590 | Medium | 2001-08-02 | Mitigation candidate | Working exploit published | Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0). |