WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2003-03-31✕Product application✕
Overview 13 matches · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
13matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC15.4% 1EPSS ≥ 0.57.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 15.4% No exploit published 11 84.6%
Critical 0 0.0% High 0 0.0% Medium 13 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 13 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 15.4% Proof of concept only 0 0.0% Forecast only 1 7.7% No public exploit 10 76.9%
split by peak 4 / quarter
No exploit published: 11Mitigation candidate: 2 Medium: 13 not blocked: 13 No public exploit: 10Forecast only: 1Working exploit published: 2
Q3 001 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Q4 000 Q1 010 Q2 010 Q3 012 Mitigation candidate1 No exploit published1 Medium2 not blocked2 Working exploit published1 No public exploit1 Q4 011 No exploit published1 Medium1 not blocked1 No public exploit1 Q1 022 No exploit published2 Medium2 not blocked2 No public exploit2 Q2 020 Q3 023 No exploit published3 Medium3 not blocked3 Forecast only1 No public exploit2 Q4 024 No exploit published4 Medium4 not blocked4 No public exploit4
Q3 00Q4 00Q1 01Q2 01Q3 01Q4 01Q1 02Q2 02Q3 02Q4 02
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2002-2347 Medium 2002-12-31 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field.
CVE-2002-1858 Medium 2002-12-31 No exploit published No public exploit Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVE-2002-1632 Medium 2002-12-31 No exploit published No public exploit Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2.
CVE-2002-1153 Medium 2002-10-11 No exploit published No public exploit IBM Websphere 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with long HTTP headers, such as "Host".
CVE-2002-0565 Medium 2002-07-03 No exploit published No public exploit Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.
CVE-2002-0563 Medium 2002-07-03 No exploit published Forecast only The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.
CVE-2002-0562 Medium 2002-07-03 No exploit published No public exploit The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.
CVE-2002-1637 Medium 2002-02-26 No exploit published No public exploit Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5) IMAGEUSER, (6) USER1, (7) USER2, (8) PLSQL, (9) DEMO, (10) FINANCE, and many others, which allows attackers to gain privileges.
CVE-2001-1372 Medium 2002-02-06 No exploit published No public exploit Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.
CVE-2001-1189 Medium 2001-12-13 No exploit published No public exploit IBM Websphere Application Server 3.5.3 and earlier stores a password in cleartext in the sas.server.props file, which allows local users to obtain the passwords via a JSP script.
CVE-2001-0390 Medium 2001-07-02 Mitigation candidate Working exploit published IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters.
CVE-2001-0389 Medium 2001-07-02 No exploit published No public exploit IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to determine the real path of the server by directly calling the macro.d2w macro with a NOEXISTINGHTMLBLOCK argument.
CVE-2000-0652 Medium 2000-07-24 Mitigation candidate Working exploit published IBM WebSphere allows remote attackers to read source code for executable web files by directly calling the default InvokerServlet using a URL which contains the "/servlet/file" string.