Overview 40 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 8 public PoC · 0 EPSS ≥ 0.5
40matches
2in Waratek scope5.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
8public PoC20.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
5.0%
Outside Waratek scope
0
0.0%
Not applicable
38
95.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
40
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
8
20.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
32
80.0%
split by
peak 7 / year
20051
Not applicable1
Medium1
not blocked1
No public exploit1
20061
Not applicable1
Medium1
not blocked1
No public exploit1
20072
Not applicable2
Medium2
not blocked2
No public exploit2
20081
Not applicable1
Medium1
not blocked1
No public exploit1
20094
Not applicable4
Medium4
not blocked4
Working exploit published2
No public exploit2
20107
Not applicable7
Medium7
not blocked7
Working exploit published2
No public exploit5
20116
Not applicable6
Medium6
not blocked6
Working exploit published2
No public exploit4
20122
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20141
Not applicable1
Medium1
not blocked1
No public exploit1
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20160
20171
Not applicable1
Medium1
not blocked1
No public exploit1
20183
Not applicable3
Medium3
not blocked3
No public exploit3
20195
No exploit published1
Not applicable4
Medium5
not blocked5
Working exploit published1
No public exploit4
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20210
20220
20231
Not applicable1
Medium1
not blocked1
No public exploit1
20241
Not applicable1
Medium1
not blocked1
No public exploit1
20250
20261
No exploit published1
Medium1
not blocked1
No public exploit1
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-60574 | Medium | 2026-07-21 | No exploit published | No public exploit | Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Cover Letter). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Content Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Content Manager accessible data as well as unauthorized read access to a subset of Oracle Content Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Content Manager. CVSS 3.1 Base Score 6.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). |
| CVE-2023-38366 | Medium | 2024-03-01 | Not applicable | No public exploit | IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 261115. |
| CVE-2023-35905 | Medium | 2023-10-04 | Not applicable | No public exploit | IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 259384. |
| CVE-2020-4447 | Medium | 2020-07-23 | Not applicable | No public exploit | IBM FileNet Content Manager 5.5.3 and 5.5.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 181227. |
| CVE-2019-3022 | Medium | 2019-10-16 | No exploit published | No public exploit | Vulnerability in the Oracle Content Manager product of Oracle E-Business Suite (component: Content). Supported versions that are affected are 12.1.1-12.1.3 and 12.2.3-12.2.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Content Manager. While the vulnerability is in Oracle Content Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Content Manager accessible data. CVSS 3.0 Base Score 5.8 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N). |
| CVE-2019-4572 | Medium | 2019-10-14 | Not applicable | No public exploit | IBM FileNet Content Manager 5.5.2 and 5.5.3 in specific configurations, could log the web service user credentials into a log file that could be accessed by an administrator on the local machine. IBM X-Force ID: 166798. |
| CVE-2019-11658 | Medium | 2019-08-30 | Not applicable | No public exploit | Information exposure in Micro Focus Content Manager, versions 9.1, 9.2 and 9.3. This vulnerability when configured to use an Oracle database, allows valid system users to gain access to a limited subset of records they would not normally be able to access when the system is in an undisclosed abnormal state. |
| CVE-2019-11653 | Medium | 2019-08-07 | Not applicable | No public exploit | Remote Access Control Bypass in Micro Focus Content Manager. versions 9.1, 9.2, 9.3. The vulnerability could be exploited to manipulate data stored during another user’s CheckIn request. |
| CVE-2018-19371 | Medium | 2019-01-02 | Not applicable | Working exploit published | The SaveUserSettings service in Content Manager in SDL Web 8.5.0 has an XXE Vulnerability that allows reading sensitive files from the system. |
| CVE-2018-1556 | Medium | 2018-07-06 | Not applicable | No public exploit | IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142893. |
| CVE-2018-1555 | Medium | 2018-07-06 | Not applicable | No public exploit | IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 142892. |
| CVE-2018-1502 | Medium | 2018-05-01 | Not applicable | No public exploit | IBM Content Manager Enterprise Edition Resource Manager 8.4.3 and 9.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 141338. |
| CVE-2016-8922 | Medium | 2017-02-01 | Not applicable | No public exploit | Exphox WebRadar is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. |
| CVE-2015-4228 | Medium | 2015-07-02 | Not applicable | No public exploit | Cisco Digital Content Manager (DCM) 15.0.0 might allow remote ad servers to cause a denial of service (reboot) via malformed ad messages, aka Bug ID CSCur13999. |
| CVE-2013-6746 | Medium | 2014-01-22 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in FileNet P8 Platform Documentation Installable Info Center 4.5.1 through 5.2.0 in IBM FileNet Business Process Manager 4.5.1 through 5.1.0, FileNet Content Manager 4.5.1 through 5.2.0, and Case Foundation 5.2.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2013-5449 | Medium | 2013-12-04 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in workingSet.jsp in IBM Eclipse Help System (IEHS), as used in the installable InfoCenter component in IBM FileNet Content Manager 4.5.1, 5.0.0, 5.1.0, and 5.2.0, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2012-2438 | Medium | 2012-11-26 | Not applicable | No public exploit | ar web content manager (AWCM) 2.2 does not restrict the number of comment records that can be submitted through HTTP requests, which allows remote attackers to cause a denial of service (disk consumption) via the coment parameter to (1) show_video.php or (2) topic.php. |
| CVE-2012-2437 | Medium | 2012-11-26 | Not applicable | Working exploit published | cookie_gen.php in ar web content manager (AWCM) 2.2 does not require authentication, which allows remote attackers to generate arbitrary cookies via the name parameter in conjunction with the content parameter. |
| CVE-2011-2754 | Medium | 2011-07-17 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the PageBuilder2 (aka Page Builder) theme in IBM WebSphere Portal 7.x before 7.0.0.1 CF006, as used in IBM Web Content Manager (WCM) and other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2010-4806 | Medium | 2011-05-26 | Not applicable | No public exploit | The authoring tool in IBM Web Content Manager (WCM) 6.1.5, and 7.0.0.1 before CF003, allows remote authenticated users to bypass intended access restrictions on draft creation by leveraging certain resource editor privileges. |
| CVE-2011-1668 | Medium | 2011-04-10 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in search.php in AR Web Content Manager (AWCM) 2.1, 2.2, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the search parameter. |
| CVE-2011-1046 | Medium | 2011-02-21 | Not applicable | No public exploit | IBM FileNet P8 Content Engine (aka P8CE) 4.0.1 through 5.0.0, as used in FileNet P8 Content Manager (CM) and FileNet P8 Business Process Manager (BPM), does not require the PRIVILEGED_WRITE access role for all intended Object Store modifications, which allows remote attackers to change a privileged property of an object via unspecified vectors. |
| CVE-2011-1045 | Medium | 2011-02-21 | Not applicable | No public exploit | Unspecified vulnerability in the Rendition Engine (aka P8RE) 4.0.1 through 4.5.1 in IBM FileNet P8 Content Manager (CM) allows remote attackers to gain privileges via unknown vectors. |
| CVE-2011-0903 | Medium | 2011-02-07 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in AR Web Content Manager (AWCM) 2.2 allow remote attackers to read arbitrary files and possibly have other unspecified impact via a .. (dot dot) in the (1) awcm_theme or (2) awcm_lang cookie to (a) index.php or (b) header.php. |
| CVE-2010-3320 | Medium | 2010-09-13 | Not applicable | No public exploit | Open redirect vulnerability in IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. |
| CVE-2010-3319 | Medium | 2010-09-13 | Not applicable | No public exploit | IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 places a session token in the URI, which might allow remote attackers to obtain sensitive information by reading a Referer log file. |
| CVE-2010-3318 | Medium | 2010-09-13 | Not applicable | No public exploit | IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 transmits passwords in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network. |
| CVE-2010-3317 | Medium | 2010-09-13 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in IBM Records Manager (RM) 4.5.x before 4.5.1.1-IER-FP001 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2010-2896 | Medium | 2010-07-28 | Not applicable | No public exploit | IBM FileNet Content Manager (CM) 4.0.0, 4.0.1, 4.5.0, and 4.5.1 before FP4 does not properly manage the InheritParentPermissions setting during an upgrade from 3.x, which might allow attackers to bypass intended folder permissions via unspecified vectors. |
| CVE-2009-4925 | Medium | 2010-07-12 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Portale e-commerce Creasito (aka creasito e-commerce content manager) 1.3.16, when magic_quotes_gpc is disabled, allow remote attackers to execute arbitrary SQL commands via the username parameter to (1) admin/checkuser.php and (2) checkuser.php. |
| CVE-2010-1066 | Medium | 2010-03-23 | Not applicable | Working exploit published | AR Web Content Manager (AWCM) 2.1 stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for control/db_backup.php. |
| CVE-2009-3588 | Medium | 2009-10-13 | Not applicable | No public exploit | Unspecified vulnerability in the arclib component in the Anti-Virus engine in CA Anti-Virus for the Enterprise (formerly eTrust Antivirus) 7.1 through r8.1; Anti-Virus 2007 (v8) through 2009; eTrust EZ Antivirus r7.1; Internet Security Suite 2007 (v3) through Plus 2009; and other CA products allows remote attackers to cause a denial of service via a crafted RAR archive file that triggers stack corruption, a different vulnerability than CVE-2009-3587. |
| CVE-2009-3219 | Medium | 2009-09-16 | Not applicable | Working exploit published | Directory traversal vulnerability in a.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the a parameter. |
| CVE-2009-3218 | Medium | 2009-09-16 | Not applicable | Working exploit published | SQL injection vulnerability in control/login.php in AR Web Content Manager (AWCM) 2.1, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the username parameter. |
| CVE-2009-1953 | Medium | 2009-06-08 | Not applicable | No public exploit | IBM FileNet Content Manager 4.0, 4.0.1, and 4.5, as used in IBM WebSphere Application Server (WAS) and Oracle BEA WebLogic Application Server, when the CE Web Services listener has a certain WSEAF configuration, does not properly restrict use of a cached Subject, which allows remote attackers to obtain access with the credentials of a recently authenticated user via unspecified vectors. |
| CVE-2008-1306 | Medium | 2008-03-12 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in Savvy Content Manager (CM) allow remote attackers to inject arbitrary web script or HTML via the searchterms parameter to (1) searchresults.cfm, (2) search_results.cfm, and (3) search_results/index.cfm. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2007-3875 | Medium | 2007-07-26 | Not applicable | No public exploit | arclib.dll before 7.3.0.9 in CA Anti-Virus (formerly eTrust Antivirus) 8 and certain other CA products allows remote attackers to cause a denial of service (infinite loop and loss of antivirus functionality) via an invalid "previous listing chunk number" field in a CHM file. |
| CVE-2007-1786 | Medium | 2007-03-31 | Not applicable | No public exploit | SQL injection vulnerability in Hitachi Collaboration - Online Community Management 01-00 through 01-30, as used in Groupmax Collaboration Portal, Groupmax Collaboration Web Client, uCosminexus Collaboration Portal, Cosminexus Collaboration Portal, and uCosminexus Content Manager, allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2006-0463 | Medium | 2006-01-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in IdeoContent Manager allows remote attackers to inject arbitrary web script or HTML via the (1) goto_id parameter to index.php or (2) page parameter to news_full.php. |
| CVE-2005-3569 | Medium | 2005-11-16 | Not applicable | No public exploit | INSO service in IBM DB2 Content Manager before 8.2 Fix Pack 10 on AIX allows attackers to cause a denial of service (application crash) via unknown attack vectors involving LZH files. |