WaratekVRT Sign in
Reset
More filters (3)
Columns
Published from 2002-01-01✕Published to 2002-12-31✕Product application server✕
Overview 14 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 2 EPSS ≥ 0.5
14matches 1protected7.1% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 2EPSS ≥ 0.514.3%
Protected by Waratek 1 7.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 13 92.9%
Critical 0 0.0% High 4 28.6% Medium 9 64.3% Low 1 7.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 7.1% partly blocked 0 0.0% not blocked 13 92.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 2 14.3% No public exploit 12 85.7%
split by peak 5 / month
No exploit published: 13Protected by Waratek: 1 Low: 1Medium: 9High: 4 not blocked: 13blocked by ARMR today: 1 No public exploit: 12Forecast only: 2
Feb 023 No exploit published3 High1 Medium2 not blocked3 No public exploit3 Mar 020 Apr 020 May 020 Jun 020 Jul 025 No exploit published5 High1 Medium3 Low1 not blocked5 Forecast only2 No public exploit3 Aug 020 Sep 020 Oct 021 No exploit published1 Medium1 not blocked1 No public exploit1 Nov 020 Dec 025 Protected by Waratek1 No exploit published4 High2 Medium3 blocked by ARMR today1 not blocked4 No public exploit5
Feb 02Mar 02Apr 02May 02Jun 02Jul 02Aug 02Sep 02Oct 02Nov 02Dec 02
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2002-2347 Medium 2002-12-31 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Oracle Java Server Page (OJSP) demo files (1) hellouser.jsp, (2) welcomeuser.jsp and (3) usebean.jsp in Oracle 9i Application Server 9.0.2, 1.0.2.2, 1.0.2.1s and 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the text entry field.
CVE-2002-1858 Medium 2002-12-31 No exploit published No public exploit Oracle Oracle9i Application Server 1.0.2.2 and 9.0.2 through 9.0.2.0.1, when running on Windows, allows remote attackers to retrieve files in the WEB-INF directory, which contains Java class files and configuration information, via a request to the WEB-INF directory with a trailing dot ("WEB-INF.").
CVE-2002-1632 Medium 2002-12-31 No exploit published No public exploit Oracle 9i Application Server (9iAS) installs multiple sample pages that allow remote attackers to obtain environment variables and other sensitive information via (1) info.jsp, (2) printenv, (3) echo, or (4) echo2.
CVE-2002-1631 High 2002-12-31 Protected by Waratek No public exploit SQL injection vulnerability in the query.xsql sample page in Oracle 9i Application Server (9iAS) allows remote attackers to execute arbitrary code via the sql parameter.
CVE-2002-1630 High 2002-12-31 No exploit published No public exploit The sendmail.jsp sample page in Oracle 9i Application Server (9iAS) allows remote attackers to send arbitrary emails.
CVE-2002-1153 Medium 2002-10-11 No exploit published No public exploit IBM Websphere 4.0.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an HTTP request with long HTTP headers, such as "Host".
CVE-2002-0569 High 2002-07-03 No exploit published No public exploit Oracle 9i Application Server allows remote attackers to bypass access restrictions for configuration files via a direct request to the XSQL Servlet (XSQLServlet).
CVE-2002-0568 Low 2002-07-03 No exploit published Forecast only Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.
CVE-2002-0565 Medium 2002-07-03 No exploit published No public exploit Oracle 9iAS 1.0.2.x compiles JSP files in the _pages directory with world-readable permissions under the web root, which allows remote attackers to obtain sensitive information derived from the JSP code, including usernames and passwords, via a direct HTTP request to _pages.
CVE-2002-0563 Medium 2002-07-03 No exploit published Forecast only The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.
CVE-2002-0562 Medium 2002-07-03 No exploit published No public exploit The default configuration of Oracle 9i Application Server 1.0.2.x running Oracle JSP or SQLJSP stores globals.jsa under the web root, which allows remote attackers to gain sensitive information including usernames and passwords via a direct HTTP request to globals.jsa.
CVE-2002-1637 Medium 2002-02-26 No exploit published No public exploit Multiple components in Oracle 9i Application Server (9iAS) are installed with over 160 default usernames and passwords, including (1) SYS, (2) SYSTEM, (3) AQJAVA, (4) OWA, (5) IMAGEUSER, (6) USER1, (7) USER2, (8) PLSQL, (9) DEMO, (10) FINANCE, and many others, which allows attackers to gain privileges.
CVE-2001-1372 Medium 2002-02-06 No exploit published No public exploit Oracle 9i Application Server 1.0.2 allows remote attackers to obtain the physical path of a file under the server root via a request for a non-existent .JSP file, which leaks the pathname in an error message.
CVE-2001-1371 High 2002-02-06 No exploit published No public exploit The default configuration of Oracle Application Server 9iAS 1.0.2.2 enables SOAP and allows anonymous users to deploy applications by default via urn:soap-service-manager and urn:soap-provider-manager.