WaratekVRT Sign in
Reset
More filters (3)
Columns
Protection: Full✕Published to 2012-01-31✕Product application✕
Overview 12 matches · 2 exploited · 2 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
12matches 2exploited16.7% 2CISA KEV16.7% 4public PoC33.3% 2EPSS ≥ 0.516.7%
Protected by Waratek 12 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 6 50.0% Medium 5 41.7% Low 1 8.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 12 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 16.7% Working exploit published 2 16.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 8 66.7%
split by peak 4 / year
Protected by Waratek: 12 Low: 1Medium: 5High: 6 blocked by ARMR today: 12 No public exploit: 8Working exploit published: 2Exploited: 2
20011 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20021 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20030 20041 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20050 20062 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 No public exploit2 20071 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20080 20091 Protected by Waratek1 Low1 blocked by ARMR today1 Working exploit published1 20104 Protected by Waratek4 High2 Medium2 blocked by ARMR today4 Exploited2 Working exploit published1 No public exploit1 20111 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
20012002200320042005200620072008200920102011
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2011-1359 Medium 2011-09-06 Protected by Waratek No public exploit Directory traversal vulnerability in the administration console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41, 7.0 before 7.0.0.19, and 8.0 before 8.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CVE-2010-1871 High 2010-08-05 Protected by Waratek Exploited JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
CVE-2010-0738 Medium 2010-04-28 Protected by Waratek Exploited The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVE-2009-2907 Medium 2010-03-24 Protected by Waratek Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in SpringSource tc Server 6.0.20.B and earlier, Application Management Suite (AMS) before 2.0.0.SR4, Hyperic HQ Open Source before 4.2.x, Hyperic HQ 4.0 Enterprise before 4.0.3.2, and Hyperic HQ 4.1 Enterprise before 4.1.2.1 allow remote attackers to inject arbitrary web script or HTML via the description field and unspecified "input fields."
CVE-2010-0386 High 2010-01-25 Protected by Waratek No public exploit The default configuration of Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method, which makes it easier for remote attackers to steal cookies and authentication credentials via a cross-site tracing (XST) attack, a related issue to CVE-2004-2763 and CVE-2005-3398.
CVE-2009-2898 Low 2009-10-13 Protected by Waratek Working exploit published Cross-site scripting (XSS) vulnerability in the Alerts list feature in the web interface in SpringSource Hyperic HQ 3.2.x before 3.2.6.1, 4.0.x before 4.0.3.1, 4.1.x before 4.1.2.1, and 4.2-beta1; Application Management Suite (AMS) 2.0.0.SR3; and tc Server 6.0.20.B allows remote authenticated users to inject arbitrary web script or HTML via the Description field. NOTE: some of these details are obtained from third party information.
CVE-2007-0222 Medium 2007-01-17 Protected by Waratek No public exploit Directory traversal vulnerability in the EmChartBean server side component for Oracle Application Server 10g allows remote attackers to read arbitrary files via unknown vectors, probably "\.." sequences in the beanId parameter. NOTE: this is likely a duplicate of another CVE that Oracle addressed in CPU Jan 2007, but due to lack of details by Oracle, it is unclear which BugID this issue is associated with, so the other CVE cannot be determined. Possibilities include EM02 (CVE-2007-0292) or EM05 (CVE-2007-0293).
CVE-2006-0289 High 2006-01-18 Protected by Waratek No public exploit Multiple unspecified vulnerabilities in Oracle Application Server 6.0.8.26(PS17) and E-Business Suite and Applications 11.5.10 have unspecified impact and attack vectors, as identified by Oracle Vuln# (1) REP05 and (2) REP06 in the Oracle Reports Developer component. NOTE: Oracle has not disputed reliable researcher claims that REP05 is the same as CVE-2005-2378 and REP06 is the same as CVE-2005-2371, both of which involve directory traversal.
CVE-2006-0275 Medium 2006-01-18 Protected by Waratek No public exploit Unspecified vulnerability in the Oracle Reports Developer component of Oracle Application Server 9.0.4.2 has unspecified impact and attack vectors, as identified by Oracle Vuln# REP04. NOTE: Oracle has not disputed reliable researcher claims that this issue is related to directory traversal that allows reading of portions of arbitrary XML files via the customize parameter.
CVE-2004-0543 High 2004-08-06 Protected by Waratek No public exploit Multiple SQL injection vulnerabilities in Oracle Applications 11.0 and Oracle E-Business Suite 11.5.1 through 11.5.8 allow remote attackers to execute arbitrary SQL procedures and queries.
CVE-2002-1631 High 2002-12-31 Protected by Waratek No public exploit SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.
CVE-2001-0591 High 2001-08-22 Protected by Waratek No public exploit Directory traversal vulnerability in Oracle JSP 1.0.x through 1.1.1 and Oracle 8.1.7 iAS Release 1.0.2 can allow a remote attacker to read or execute arbitrary .jsp files via a '..' (dot dot) attack.