WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product myfaces✕
Overview 7 matches · 6 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
7matches 6in Waratek scope85.7% 2protected28.6% 0exploited0.0% 0CISA KEV0.0% 2public PoC28.6% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 28.6% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 57.1% Outside Waratek scope 0 0.0% Not applicable 1 14.3% Withdrawn CVE 0 0.0%
Critical 1 14.3% High 2 28.6% Medium 4 57.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 28.6% partly blocked 0 0.0% not blocked 5 71.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 28.6% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 71.4%
split by peak 2 / year
Not applicable: 1No exploit published: 4Protected by Waratek: 2 Medium: 4High: 2Critical: 1 not blocked: 5blocked by ARMR today: 2 No public exploit: 5Working exploit published: 2
20071 Not applicable1 Medium1 not blocked1 Working exploit published1 20080 20090 20102 No exploit published2 Medium2 not blocked2 No public exploit2 20110 20120 20130 20141 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20150 20161 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20171 No exploit published1 High1 not blocked1 No public exploit1 20180 20190 20200 20211 No exploit published1 High1 not blocked1 No public exploit1
20072009201120132015201720192021
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-26296 High 2021-02-19 No exploit published No public exploit In the default configuration, Apache MyFaces Core versions 2.2.0 to 2.2.13, 2.3.0 to 2.3.7, 2.3-next-M1 to 2.3-next-M4, and 3.0.0-RC1 use cryptographically weak implicit and explicit cross-site request forgery (CSRF) tokens. Due to that limitation, it is possible (although difficult) for an attacker to calculate a future CSRF token value and to use that value to trick a user into executing unwanted actions on an application.
CVE-2011-4343 High 2017-08-08 No exploit published No public exploit Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
CVE-2016-5019 Critical 2016-10-03 Protected by Waratek No public exploit CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 might allow attackers to conduct deserialization attacks via a crafted serialized view state string.
CVE-2011-4367 Medium 2014-06-19 Protected by Waratek Working exploit published Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
CVE-2010-2057 Medium 2010-10-20 No exploit published No public exploit shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
CVE-2010-2086 Medium 2010-05-27 No exploit published No public exploit Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
CVE-2007-3101 Medium 2007-06-18 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.