WaratekVRT Sign in

BEA Tuxedo CVEs

4 CVEs

Reset
More filters (2)
Columns
Vendor bea✕Product tuxedo✕
Overview 4 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
4matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC25.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 25.0% No exploit published 3 75.0%
Critical 0 0.0% High 0 0.0% Medium 4 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 25.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 3 / quarter
No exploit published: 3Mitigation candidate: 1 Medium: 4 not blocked: 4 No public exploit: 3Working exploit published: 1
Q4 033 Mitigation candidate1 No exploit published2 Medium3 not blocked3 Working exploit published1 No public exploit2 Q1 040 Q2 040 Q3 040 Q4 040 Q1 050 Q2 050 Q3 050 Q4 050 Q1 060 Q2 060 Q3 060 Q4 060 Q1 070 Q2 070 Q3 070 Q4 071 No exploit published1 Medium1 not blocked1 No public exploit1
Q4 03Q2 04Q4 04Q2 05Q4 05Q2 06Q4 06Q2 07Q4 07
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2007-5576 Medium 2007-10-18 No exploit published No public exploit BEA Tuxedo 8.0 before RP392 and 8.1 before RP293, and WebLogic Enterprise 5.1 before RP174, echo the password in cleartext, which allows physically proximate attackers to obtain sensitive information via the (1) cnsbind, (2) cnsunbind, or (3) cnsls commands.
CVE-2003-0623 Medium 2003-12-01 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to inject arbitrary web script via the INIFILE argument.
CVE-2003-0622 Medium 2003-12-01 No exploit published No public exploit The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to cause a denial of service (hang) via pathname arguments that contain MS-DOS device names such as CON and AUX.
CVE-2003-0621 Medium 2003-12-01 Mitigation candidate Working exploit published The Administration Console for BEA Tuxedo 8.1 and earlier allows remote attackers to determine the existence of files outside the web root via modified paths in the INIFILE argument.