WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Product jboss application server✕
Overview 8 matches · 2 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
8matches 2in Waratek scope25.0% 0protected0.0% 1exploited12.5% 0CISA KEV0.0% 1public PoC12.5% 1EPSS ≥ 0.512.5%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 25.0% Outside Waratek scope 0 0.0% Not applicable 6 75.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 4 50.0% Medium 4 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 12.5% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 87.5%
split by peak 3 / year
Not applicable: 6No exploit published: 2 Medium: 4High: 4 not blocked: 8 No public exploit: 7Exploited: 1
20061 Not applicable1 High1 not blocked1 No public exploit1 20072 Not applicable2 High1 Medium1 not blocked2 Exploited1 No public exploit1 20080 20090 20100 20110 20120 20130 20140 20150 20160 20171 Not applicable1 Medium1 not blocked1 No public exploit1 20180 20193 No exploit published1 Not applicable2 High1 Medium2 not blocked3 No public exploit3 20201 No exploit published1 High1 not blocked1 No public exploit1
20062008201020122014201620182020
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2012-1094 High 2020-03-10 No exploit published No public exploit JBoss AS 7 prior to 7.1.1 and mod_cluster do not handle default hostname in the same way, which can cause the excluded-contexts list to be mismatched and the root context to be exposed.
CVE-2012-2312 High 2019-12-18 No exploit published No public exploit An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges.
CVE-2011-3609 Medium 2019-11-26 Not applicable No public exploit A CSRF issue was found in JBoss Application Server 7 before 7.1.0. JBoss did not properly restrict access to the management console information (for example via the "Access-Control-Allow-Origin" HTTP access control flag). This can lead to unauthorized information leak if a user with admin privileges visits a specially-crafted web page provided by a remote attacker.
CVE-2011-3606 Medium 2019-11-26 Not applicable No public exploit A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user, with the administrator privilege, to visit it, which would lead into the DOM environment modification and arbitrary HTML or web script execution.
CVE-2013-3734 Medium 2017-10-24 Not applicable No public exploit The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow (1) man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or (2) attackers to obtain sensitive information by reading the HTML source code. NOTE: the vendor says that this does not cross a trust boundary and that it is recommended best-practice that SSL is configured for the administrative console
CVE-2007-1354 Medium 2007-07-27 Not applicable No public exploit The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable to store the roles of the current user, which allows remote authenticated administrators to trigger a race condition and gain privileges by logging in during a session by a more privileged administrator, as demonstrated by privilege escalation from Read Mode to Write Mode.
CVE-2007-1036 High 2007-02-21 Not applicable Exploited The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.
CVE-2006-5750 High 2006-11-27 Not applicable No public exploit Directory traversal vulnerability in the DeploymentFileRepository class in JBoss Application Server (jbossas) 3.2.4 through 4.0.5 allows remote authenticated users to read or modify arbitrary files, and possibly execute arbitrary code, via unspecified vectors related to the console manager.