WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product myfaces✕
Overview 4 matches · 3 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
4matches 3in Waratek scope75.0% 1protected25.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC50.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 50.0% Outside Waratek scope 0 0.0% Not applicable 1 25.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 4 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 25.0% partly blocked 0 0.0% not blocked 3 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 50.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 50.0%
split by peak 2 / year
Not applicable: 1No exploit published: 2Protected by Waratek: 1 Medium: 4 not blocked: 3blocked by ARMR today: 1 No public exploit: 2Working exploit published: 2
20071 Not applicable1 Medium1 not blocked1 Working exploit published1 20080 20090 20102 No exploit published2 Medium2 not blocked2 No public exploit2 20110 20120 20130 20141 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1
20072008200920102011201220132014
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2011-4367 Medium 2014-06-19 Protected by Waratek Working exploit published Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
CVE-2010-2057 Medium 2010-10-20 No exploit published No public exploit shared/util/StateUtils.java in Apache MyFaces 1.1.x before 1.1.8, 1.2.x before 1.2.9, and 2.0.x before 2.0.1 uses an encrypted View State without a Message Authentication Code (MAC), which makes it easier for remote attackers to perform successful modifications of the View State via a padding oracle attack.
CVE-2010-2086 Medium 2010-05-27 No exploit published No public exploit Apache MyFaces 1.1.7 and 1.2.8, as used in IBM WebSphere Application Server and other applications, does not properly handle an unencrypted view state, which allows remote attackers to conduct cross-site scripting (XSS) attacks or execute arbitrary Expression Language (EL) statements via vectors that involve modifying the serialized view object.
CVE-2007-3101 Medium 2007-06-18 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in certain JSF applications in Apache MyFaces Tomahawk before 1.1.6 allow remote attackers to inject arbitrary web script via the autoscroll parameter, which is injected into Javascript that is sent to the client.