WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2012-11-30✕Product http✕
Overview 5 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
5matches 1protected20.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 20.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 80.0%
Critical 0 0.0% High 0 0.0% Medium 5 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 20.0% partly blocked 0 0.0% not blocked 4 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 100.0%
split by peak 2 / year
No exploit published: 4Protected by Waratek: 1 Medium: 5 not blocked: 4blocked by ARMR today: 1 No public exploit: 5
20041 No exploit published1 Medium1 not blocked1 No public exploit1 20050 20060 20071 No exploit published1 Medium1 not blocked1 No public exploit1 20080 20090 20100 20111 No exploit published1 Medium1 not blocked1 No public exploit1 20122 Protected by Waratek1 No exploit published1 Medium2 blocked by ARMR today1 not blocked1 No public exploit2
200420052006200720082009201020112012
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2012-5785 Medium 2012-11-04 No exploit published No public exploit Apache Axis2/Java 1.6.2 and earlier does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-5783 Medium 2012-11-04 Protected by Waratek No public exploit Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2011-1498 Medium 2011-07-07 No exploit published No public exploit Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.
CVE-2006-6969 Medium 2007-02-07 No exploit published No public exploit Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.
CVE-2004-2381 Medium 2004-12-31 No exploit published No public exploit HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length.