Overview 24 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
24matches
1in Waratek scope4.2%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
4.2%
Outside Waratek scope
0
0.0%
Not applicable
23
95.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
24
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
24
100.0%
split by
peak 8 / year
20071
Not applicable1
Low1
not blocked1
No public exploit1
20081
Not applicable1
Low1
not blocked1
No public exploit1
20093
Not applicable3
Low3
not blocked3
No public exploit3
20100
20110
20120
20132
Not applicable2
Low2
not blocked2
No public exploit2
20141
Not applicable1
Low1
not blocked1
No public exploit1
20150
20160
20174
Not applicable4
Low4
not blocked4
No public exploit4
20182
Not applicable2
Low2
not blocked2
No public exploit2
20191
Not applicable1
Low1
not blocked1
No public exploit1
20200
20210
20220
20230
20240
20258
Not applicable8
Low8
not blocked8
No public exploit8
20261
No exploit published1
Low1
not blocked1
No public exploit1
2008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-83369 | Low | 2026-09-15 | No exploit published | No public exploit | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Access SDK). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 3.1 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L). |
| CVE-2023-42242 | Low | 2025-01-13 | Not applicable | No public exploit | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/s_terminal.php. |
| CVE-2023-42241 | Low | 2025-01-13 | Not applicable | No public exploit | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_anagraphic.php. |
| CVE-2023-42240 | Low | 2025-01-13 | Not applicable | No public exploit | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /monitor/s_scheduledfile.php. |
| CVE-2023-42239 | Low | 2025-01-13 | Not applicable | No public exploit | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_ep.php. |
| CVE-2023-42238 | Low | 2025-01-13 | Not applicable | No public exploit | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple POST parameters of /vam/vam_eps.php. |
| CVE-2023-42237 | Low | 2025-01-13 | Not applicable | No public exploit | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple GET parameters of /vam/vam_i_command.php. |
| CVE-2023-42236 | Low | 2025-01-13 | Not applicable | No public exploit | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php. |
| CVE-2023-42235 | Low | 2025-01-13 | Not applicable | No public exploit | An issue was discovered in Selesta Visual Access Manager (VAM) prior to 4.42.2. An authenticated attacker can perform SQL Injection in multiple parameters of /monitor/s_normalizedtrans.php. |
| CVE-2019-4150 | Low | 2019-06-25 | Not applicable | No public exploit | IBM Security Access Manager 9.0.1 through 9.0.6 does not validate, or incorrectly validates, a certificate which could allow an attacker to spoof a trusted entity by using a man-in-the-middle (MITM) attack. IBM X-Force ID: 158510. |
| CVE-2018-1804 | Low | 2018-12-13 | Not applicable | No public exploit | IBM Security Access Manager Appliance 9.0.1.0, 9.0.2.0, 9.0.3.0, 9.0.4.0, and 9.0.5.0 does not set the secure attribute on authorization tokens or session cookies. This could allow an attacker to obtain sensitive information using man in the middle techniques. IBM X-Force ID: 149703. |
| CVE-2017-1478 | Low | 2018-01-11 | Not applicable | No public exploit | IBM Security Access Manager Appliance 9.0.0 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 128613. |
| CVE-2017-5190 | Low | 2017-04-20 | Not applicable | No public exploit | NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to a stale profile. |
| CVE-2016-3046 | Low | 2017-02-01 | Not applicable | No public exploit | IBM Security Access Manager for Web is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements which could allow the attacker to view information in the back-end database. |
| CVE-2016-3045 | Low | 2017-02-01 | Not applicable | No public exploit | IBM Security Access Manager for Web stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referer header or browser history. |
| CVE-2016-3021 | Low | 2017-02-01 | Not applicable | No public exploit | IBM Security Access Manager for Web could allow an authenticated attacker to obtain sensitive information from error message using a specially crafted HTTP request. |
| CVE-2014-3052 | Low | 2014-06-21 | Not applicable | No public exploit | The reverse-proxy feature in IBM Security Access Manager (ISAM) for Web 8.0 with firmware 8.0.0.2 and 8.0.0.3 interprets the jct-nist-compliance parameter in the opposite of the intended manner, which makes it easier for remote attackers to obtain sensitive information by leveraging weak SSL encryption settings that lack NIST SP 800-131A compliance. |
| CVE-2013-5420 | Low | 2013-12-23 | Not applicable | No public exploit | The IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to read log files by leveraging helpdesk privileges for a direct request. |
| CVE-2013-6745 | Low | 2013-12-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the IMS server before Ifix 6 in IBM Security Access Manager for Enterprise Single Sign-On (ISAM ESSO) 8.2 allows remote authenticated users to inject arbitrary web script or HTML via crafted input to an unspecified dynamic web form. |
| CVE-2009-2712 | Low | 2009-08-07 | Not applicable | No public exploit | Sun Java System Access Manager 6.3 2005Q1, 7.0 2005Q4, and 7.1; and OpenSSO Enterprise 8.0; when AMConfig.properties enables the debug flag, allows local users to discover cleartext passwords by reading debug files. |
| CVE-2009-2268 | Low | 2009-07-01 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Cross-Domain Controller (CDC) servlet in Sun Java System Access Manager 6 2005Q1, 7 2005Q4, and 7.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2008-6722 | Low | 2009-04-14 | Not applicable | No public exploit | Novell Access Manager 3 SP4 does not properly expire X.509 certificate sessions, which allows physically proximate attackers to obtain a logged-in session by using a victim's web-browser process that continues to send the original and valid SSL sessionID, related to inability of Apache Tomcat to clear entries from its SSL cache. |
| CVE-2008-4747 | Low | 2008-10-27 | Not applicable | No public exploit | Unspecified vulnerability in the search feature in Sun Java System LDAP JDK before 4.20 allows context-dependent attackers to obtain sensitive information via unknown attack vectors related to the LDAP JDK library. |
| CVE-2007-3700 | Low | 2007-07-11 | Not applicable | No public exploit | Sun Java System Access Manager (formerly Java System Identity Server) before 20070710, when the message debug level is configured in the com.iplanet.services.debug.level property in AMConfig.properties, logs cleartext login passwords, which allows local users to gain privileges by reading /var/opt/SUNWam/debug/amAuth. |