WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product geronimo✕
Overview 4 matches · 3 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
4matches 3in Waratek scope75.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 3public PoC75.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 3 75.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 1 25.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 4 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 75.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 1 25.0%
split by peak 2 / quarter
Not applicable: 1Mitigation candidate: 3 Medium: 4 not blocked: 4 No public exploit: 1Working exploit published: 3
Q1 061 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Q2 060 Q3 060 Q4 060 Q1 070 Q2 070 Q3 071 Not applicable1 Medium1 not blocked1 No public exploit1 Q4 070 Q1 080 Q2 080 Q3 080 Q4 080 Q1 090 Q2 092 Mitigation candidate2 Medium2 not blocked2 Working exploit published2
Q2 06Q4 06Q2 07Q4 07Q2 08Q4 08Q2 09
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2009-0039 Medium 2009-04-17 Mitigation candidate Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
CVE-2009-0038 Medium 2009-04-17 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
CVE-2007-5085 Medium 2007-09-26 Not applicable No public exploit Unspecified vulnerability in the management EJB (MEJB) in Apache Geronimo before 2.0.2 allows remote attackers to bypass authentication and obtain "access to Geronimo internals" via unspecified vectors.
CVE-2006-0254 Medium 2006-01-18 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.