WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product java system access manager✕
Overview 8 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
8matches 1in Waratek scope12.5% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC12.5% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 12.5% Outside Waratek scope 0 0.0% Not applicable 7 87.5% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 8 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 12.5% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 87.5%
split by peak 2 / quarter
Not applicable: 7No exploit published: 1 Medium: 8 not blocked: 8 No public exploit: 7Working exploit published: 1
Q1 071 Not applicable1 Medium1 not blocked1 No public exploit1 Q2 070 Q3 070 Q4 071 No exploit published1 Medium1 not blocked1 No public exploit1 Q1 081 Not applicable1 Medium1 not blocked1 No public exploit1 Q2 080 Q3 080 Q4 080 Q1 092 Not applicable2 Medium2 not blocked2 Working exploit published1 No public exploit1 Q2 090 Q3 091 Not applicable1 Medium1 not blocked1 No public exploit1 Q4 090 Q1 100 Q2 100 Q3 100 Q4 100 Q1 111 Not applicable1 Medium1 not blocked1 No public exploit1 Q2 111 Not applicable1 Medium1 not blocked1 No public exploit1
Q2 07Q4 07Q2 08Q4 08Q2 09Q4 09Q2 10Q4 10Q2 11
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2011-0846 Medium 2011-04-20 Not applicable No public exploit Unspecified vulnerability in the Oracle Sun Java System Access Manager Policy Agent 2.2 allows remote attackers to affect availability via unknown vectors related to Web Proxy Agent.
CVE-2010-4444 Medium 2011-01-19 Not applicable No public exploit Unspecified vulnerability in Oracle Sun Java System Access Manager and Oracle OpenSSO 7, 7.1, and 8 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2009-2713 Medium 2009-08-07 Not applicable No public exploit The CDCServlet component in Sun Java System Access Manager 7.0 2005Q4 and 7.1, when Cross Domain Single Sign On (CDSSO) is enabled, does not ensure that "policy advice" is presented to the correct client, which allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2009-0348 Medium 2009-01-29 Not applicable Working exploit published The login module in Sun Java System Access Manager 6 2005Q1 (aka 6.3), 7 2005Q4 (aka 7.0), and 7.1 responds differently to a failed login attempt depending on whether the user account exists, which allows remote attackers to enumerate valid usernames.
CVE-2009-0170 Medium 2009-01-16 Not applicable No public exploit Sun Java System Access Manager 6.3 2005Q1, 7 2005Q4, and 7.1 allows remote authenticated users with console privileges to discover passwords, and obtain unspecified other "access to resources," by visiting the Configuration Items component in the console.
CVE-2008-1204 Medium 2008-03-08 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the Administration Console in Sun Java System Access Manager 7.1 and 7 2005Q4 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the (1) Help and (2) Version windows.
CVE-2007-5153 Medium 2007-10-01 No exploit published No public exploit Unspecified vulnerability in Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 8.x container, allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2007-0628 Medium 2007-01-31 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in Sun Java System Access Manager 6.1, 6.2, 6 2005Q1 (6.3), and 7 2005Q4 (7.0) before 20070129 allow remote attackers to inject arbitrary web script or HTML via the (1) goto or (2) gx-charset parameter. NOTE: some of these details are obtained from third party information.