WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor eclipse✕Product mojarra✕
Overview 4 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
4matches 0exploited0.0% 0CISA KEV0.0% 1public PoC25.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 4 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 2 50.0% Medium 2 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 25.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 1 / year
Protected by Waratek: 4 Medium: 2High: 2 blocked by ARMR today: 4 No public exploit: 3Working exploit published: 1
20181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20200 20211 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20220 20230 20240 20250 20261 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
201820192020202120222023202420252026
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-46581 High 2026-08-05 Protected by Waratek No public exploit In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.
CVE-2020-6950 Medium 2021-06-02 Protected by Waratek Working exploit published Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVE-2019-17091 Medium 2019-10-02 Protected by Waratek No public exploit faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
CVE-2018-14371 High 2018-07-18 Protected by Waratek No public exploit The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.