WaratekVRT Sign in
Reset
More filters (1)
Columns
Product mojarra✕
Overview 5 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
5matches 0exploited0.0% 0CISA KEV0.0% 1public PoC20.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 5 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 2 40.0% Medium 3 60.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 20.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 4 80.0%
split by peak 1 / year
Protected by Waratek: 5 Medium: 3High: 2 blocked by ARMR today: 5 No public exploit: 4Working exploit published: 1
20141 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20150 20160 20170 20181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20200 20211 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20220 20230 20240 20250 20261 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
2014201620182020202220242026
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-46581 High 2026-08-05 Protected by Waratek No public exploit In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`.
CVE-2020-6950 Medium 2021-06-02 Protected by Waratek Working exploit published Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVE-2019-17091 Medium 2019-10-02 Protected by Waratek No public exploit faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled.
CVE-2018-14371 High 2018-07-18 Protected by Waratek No public exploit The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.
CVE-2013-5855 Medium 2014-07-17 Protected by Waratek No public exploit Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.