WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: None✕Published to 2014-04-30✕
Overview 1,907 matches · 0 protected · 9 exploited · 0 CISA KEV · 129 public PoC · 39 EPSS ≥ 0.5
1,907matches 0protected0.0% 9exploited0.5% 0CISA KEV0.0% 129public PoC6.8% 39EPSS ≥ 0.52.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 135 7.1% No exploit published 1,772 92.9%
Critical 1 0.1% High 402 21.1% Medium 1,223 64.1% Low 281 14.7% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 1,907 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 9 0.5% Working exploit published 125 6.6% Proof of concept only 0 0.0% Forecast only 4 0.2% No public exploit 1,769 92.8%
split by peak 322 / year
No exploit published: 1,772Mitigation candidate: 135 Low: 281Medium: 1,223High: 402Critical: 1 not blocked: 1,907 No public exploit: 1,769Forecast only: 4Working exploit published: 125Exploited: 9
19961 No exploit published1 High1 not blocked1 No public exploit1 19970 19980 19992 No exploit published2 High2 not blocked2 No public exploit2 200012 Mitigation candidate6 No exploit published6 High5 Medium7 not blocked12 Working exploit published6 No public exploit6 200112 Mitigation candidate2 No exploit published10 High6 Medium6 not blocked12 Working exploit published2 No public exploit10 200234 Mitigation candidate8 No exploit published26 High10 Medium21 Low3 not blocked34 Working exploit published8 Forecast only2 No public exploit24 200337 Mitigation candidate7 No exploit published30 High9 Medium22 Low6 not blocked37 Working exploit published7 No public exploit30 200425 Mitigation candidate1 No exploit published24 High5 Medium17 Low3 not blocked25 Working exploit published1 No public exploit24 200579 Mitigation candidate4 No exploit published75 Critical1 High30 Medium43 Low5 not blocked79 Working exploit published4 No public exploit75 2006125 Mitigation candidate4 No exploit published121 High62 Medium52 Low11 not blocked125 Working exploit published4 No public exploit121 2007144 Mitigation candidate10 No exploit published134 High65 Medium69 Low10 not blocked144 Working exploit published10 No public exploit134 2008129 Mitigation candidate9 No exploit published120 High43 Medium79 Low7 not blocked129 Working exploit published9 No public exploit120 2009194 Mitigation candidate13 No exploit published181 High49 Medium124 Low21 not blocked194 Exploited1 Working exploit published12 No public exploit181 2010174 Mitigation candidate12 No exploit published162 High25 Medium127 Low22 not blocked174 Exploited1 Working exploit published11 Forecast only1 No public exploit161 2011187 Mitigation candidate9 No exploit published178 High19 Medium135 Low33 not blocked187 Working exploit published9 No public exploit178 2012300 Mitigation candidate22 No exploit published278 High27 Medium193 Low80 not blocked300 Exploited3 Working exploit published19 No public exploit278 2013322 Mitigation candidate17 No exploit published305 High33 Medium236 Low53 not blocked322 Exploited2 Working exploit published14 Forecast only1 No public exploit305 2014130 Mitigation candidate11 No exploit published119 High11 Medium92 Low27 not blocked130 Exploited2 Working exploit published9 No public exploit119
1996199820002002200420062008201020122014
1,907 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 20 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2014-0113 High 2014-04-29 Mitigation candidate Exploited CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.
CVE-2013-6469 Medium 2014-04-22 No exploit published No public exploit JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language (MVEL) expression. NOTE: some of these details are obtained from third party information.
CVE-2014-0111 Medium 2014-04-17 No exploit published No public exploit Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."
CVE-2014-0085 Low 2014-04-17 No exploit published No public exploit JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.
CVE-2014-2471 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle iLearning component in Oracle iLearning 6.0 and 6.1 allows remote attackers to affect integrity via unknown vectors related to Learner Pages.
CVE-2014-2470 High 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0, 10.3.6.0, 12.1.1.0, and 12.1.2.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Security.
CVE-2014-2468 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Siebel UI Framework component in Oracle Siebel CRM 8.1.1 and 8.2.2 allows remote attackers to affect integrity via vectors related to Open_UI, a different vulnerability than CVE-2014-4230.
CVE-2014-2467 Low 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2445.
CVE-2014-2466 Low 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
CVE-2014-2465 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote attackers to affect integrity via unknown vectors related to Security.
CVE-2014-2464 Low 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
CVE-2014-2461 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote attackers to affect confidentiality via unknown vectors related to Security.
CVE-2014-2460 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 5.5.06, 6.0, 6.1, 6.2, 6.3, 6.3.1, 6.3.2, and 6.3.3 allows remote authenticated users to affect confidentiality via vectors related to CSV Management.
CVE-2014-2459 Low 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.3.2 and 6.3.3 allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Security.
CVE-2014-2458 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.1.0.3 and 6.1.1.3 allows remote attackers to affect integrity via unknown vectors related to Install.
CVE-2014-2457 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile Product Lifecycle component in Oracle Supply Chain Products Suite 6.0 and 6.1.0 allows remote attackers to affect integrity via unknown vectors related to Install.
CVE-2014-2455 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to User Interface.
CVE-2014-2454 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect confidentiality via unknown vectors related to User Interface.
CVE-2014-2453 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Hyperion Common Admin component in Oracle Hyperion 11.1.2.2 and 11.1.2.3 allows remote attackers to affect integrity via unknown vectors related to User Interface.
CVE-2014-2452 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 allows remote authenticated users to affect availability via unknown vectors related to Webserver Plugin.
CVE-2014-2449 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise HRMS Talent Acquisition Manager component in Oracle PeopleSoft Products 9.0, 9.1, and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
CVE-2014-2448 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Install and Packaging.
CVE-2014-2447 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Integration Broker, a different vulnerability than CVE-2014-2437.
CVE-2014-2446 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via vectors related to QAS.
CVE-2014-2445 Low 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile PLM Framework component in Oracle Supply Chain Products Suite 9.3.3 allows remote authenticated users to affect integrity via unknown vectors related to Security, a different vulnerability than CVE-2014-2467.
CVE-2014-2443 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology.
CVE-2014-2437 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Integration Broker, a different vulnerability than CVE-2014-2447.
CVE-2014-2433 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PT PeopleTools component in Oracle PeopleSoft Products 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker.
CVE-2014-2429 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise CS Campus Self Service component in Oracle PeopleSoft Products 9.0 allows remote authenticated users to affect confidentiality via unknown vectors related to Campus Mobile.
CVE-2014-2426 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity and availability via unknown vectors related to Admin Console.
CVE-2014-2425 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect confidentiality via unknown vectors.
CVE-2014-2424 Medium 2014-04-16 Mitigation candidate Working exploit published Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system.
CVE-2014-2418 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2416, and CVE-2014-2417.
CVE-2014-2417 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2416, and CVE-2014-2418.
CVE-2014-2416 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2415, CVE-2014-2417, and CVE-2014-2418.
CVE-2014-2415 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2407, CVE-2014-2416, CVE-2014-2417, and CVE-2014-2418.
CVE-2014-2411 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Identity Analytics component in Oracle Fusion Middleware Oracle Identity Analytics 11.1.1.5 and Sun Role Manager 5.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors related to Security.
CVE-2014-2407 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Data Integrator component in Oracle Fusion Middleware 11.1.1.3.0 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Data Quality, a different vulnerability than CVE-2014-2415, CVE-2014-2416, CVE-2014-2417, and CVE-2014-2418.
CVE-2014-2404 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 10.1.4.3, 11.1.1.3.0, 11.1.1.5.0, 11.1.1.7.0, 11.1.2.0.0, 11.1.2.1.0, and 11.1.2.2.0 allows remote authenticated users to affect confidentiality via unknown vectors related to WebGate.
CVE-2014-2400 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2399.
CVE-2014-2399 Medium 2014-04-16 Mitigation candidate Working exploit published Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2400.
CVE-2014-2398 Low 2014-04-16 No exploit published No public exploit Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.
CVE-2014-0465 Low 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle OpenSSO component in Oracle Fusion Middleware 8.0 Update 2 Patch 5 allows remote authenticated users to affect integrity via unknown vectors related to Admin Console.
CVE-2014-0450 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle WebCenter Portal component in Oracle Fusion Middleware 11.1.1.7 and 11.1.1.8 allows remote attackers to affect confidentiality via unknown vectors related to People Connection.
CVE-2014-0429 High 2014-04-16 No exploit published No public exploit Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVE-2014-0426 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0413.
CVE-2014-0414 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality via vectors related to HTTP Request Handling.
CVE-2014-0413 Medium 2014-04-16 No exploit published No public exploit Unspecified vulnerability in the Oracle Containers for J2EE component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect integrity via vectors related to HTTP Request Handling, a different vulnerability than CVE-2014-0426.
CVE-2014-2741 High 2014-04-11 No exploit published No public exploit nio/XMLLightweightParser.java in Ignite Realtime Openfire before 3.9.2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack.
CVE-2013-6468 Medium 2014-04-10 No exploit published No public exploit JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.
CVE-2013-2033 Low 2014-04-10 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-0093 Medium 2014-04-03 No exploit published No public exploit Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.
CVE-2014-0050 High 2014-04-01 Mitigation candidate Working exploit published MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
CVE-2012-0032 Low 2014-04-01 No exploit published No public exploit Red Hat JBoss Operations Network (JON) before 3.0.1 uses 0777 permissions for the root directory when installing a remote client, which allows local users to read or modify subdirectories and files within the root directory, as demonstrated by obtaining JON credentials.
CVE-2011-4573 Low 2014-04-01 No exploit published No public exploit Red Hat JBoss Operations Network (JON) before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail.
CVE-2014-0086 Medium 2014-03-31 No exploit published No public exploit The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests.
CVE-2014-1904 Medium 2014-03-20 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.
CVE-2014-0094 Medium 2014-03-11 Mitigation candidate Exploited The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
CVE-2014-2067 Low 2014-03-01 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in java/hudson/model/Cause.java in Jenkins before 1.551 and LTS before 1.532.2 allows remote authenticated users to inject arbitrary web script or HTML via a "remote cause note."
CVE-2014-0058 Low 2014-02-26 No exploit published No public exploit The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.
CVE-2013-4322 Medium 2014-02-26 No exploit published No public exploit Apache Tomcat before 6.0.39, 7.x before 7.0.50, and 8.x before 8.0.0-RC10 processes chunked transfer coding without properly handling (1) a large total amount of chunked data or (2) whitespace characters in an HTTP header value within a trailer field, which allows remote attackers to cause a denial of service by streaming data. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3544.
CVE-2011-4580 Medium 2014-02-26 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-2941 Medium 2014-02-26 No exploit published No public exploit Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the initialURI parameter.
CVE-2013-0346 Low 2014-02-15 No exploit published No public exploit Apache Tomcat 7.x uses world-readable permissions for the log directory and its files, which might allow local users to obtain sensitive information by reading a file. NOTE: One Tomcat distributor has stated "The tomcat log directory does not contain any sensitive information."
CVE-2014-0018 Low 2014-02-14 No exploit published No public exploit Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry, which allows local users to modify the server via a crafted deployment.
CVE-2012-1100 Medium 2014-02-14 No exploit published No public exploit Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request.
CVE-2012-0062 Medium 2014-02-14 No exploit published No public exploit Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token.
CVE-2012-0052 Medium 2014-02-14 No exploit published No public exploit Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers to spoof the identity of arbitrary agents via the registered agent name.
CVE-2014-1876 Medium 2014-02-10 No exploit published No public exploit The unpacker::redirect_stdio function in unpack.cpp in unpack200 in OpenJDK 6, 7, and 8; Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 does not securely create temporary files when a log file cannot be opened, which allows local users to overwrite arbitrary files via a symlink attack on /tmp/unpack.log.
CVE-2011-4610 Medium 2014-02-10 No exploit published No public exploit JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service (infinite loop) via vectors related to a crafted UTF-8 and a "surrogate pair character" that is "at the boundary of an internal buffer."
CVE-2013-1880 Medium 2014-02-05 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.
CVE-2012-3427 Medium 2014-02-02 No exploit published No public exploit A flaw was found in JBoss Enterprise Application Platform (EAP) and EC2 Amazon Machine Image (AMI). Incorrect permissions (755) for the /var/cache/jboss-ec2-eap/ directory allow a local user to read sensitive files. This vulnerability can lead to information disclosure, specifically exposing Amazon Web Services (AWS) credentials.
CVE-2014-1202 High 2014-01-25 Mitigation candidate Working exploit published The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
CVE-2013-2192 Low 2014-01-24 No exploit published No public exploit The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.
CVE-2013-0485 High 2014-01-21 No exploit published No public exploit Unspecified vulnerability in IBM Java SDK 7 before SR4-FP1, 6 before SR13-FP1, 5.0 before SR16-FP1, and 1.4.2 before SR13-FP16 has unknown impact and attack vectors related to Class Libraries.
CVE-2013-6725 Low 2014-01-16 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in the Administrative Console in IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a crafted URL.
CVE-2013-6330 Low 2014-01-16 No exploit published No public exploit IBM WebSphere Application Server 7.x before 7.0.0.31, when simpleFileServlet static file caching is enabled, allows remote authenticated users to obtain sensitive information via unspecified vectors.
CVE-2013-6325 Medium 2014-01-16 No exploit published No public exploit IBM WebSphere Application Server 7.x before 7.0.0.31, 8.0.x before 8.0.0.8, and 8.5.x before 8.5.5.2 allows remote attackers to cause a denial of service (resource consumption) via a crafted request to a web services endpoint.
CVE-2014-0445 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0381.
CVE-2014-0444 Low 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the Oracle AutoVue Electro-Mechanical Professional component in Oracle Supply Chain Products Suite 20.1.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Web General, a different vulnerability than CVE-2013-5868 and CVE-2013-5871.
CVE-2014-0443 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 allows remote attackers to affect integrity via unknown vectors related to Security.
CVE-2014-0441 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect availability via unknown vectors related to Integration Broker.
CVE-2014-0440 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect availability via vectors related to PIA Core Technology.
CVE-2014-0439 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect integrity via unknown vectors related to Report Distribution.
CVE-2014-0438 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote authenticated users to affect confidentiality via unknown vectors related to Panel Processor.
CVE-2014-0435 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.1, 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect availability via unknown vectors related to Data, Domain & Function Security.
CVE-2014-0434 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the Oracle Agile Product Lifecycle Management for Process component in Oracle Supply Chain Products Suite 6.0, 6.1, and 6.1.1 allows remote attackers to affect integrity via unknown vectors related to Installation.
CVE-2014-0425 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise SCM Services Procurement component in Oracle PeopleSoft Products 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
CVE-2014-0400 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the Oracle Internet Directory component in Oracle Fusion Middleware 11.1.1.6 and 11.1.1.7 allows remote authenticated users to affect confidentiality via vectors related to OID LDAP server.
CVE-2014-0399 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the Oracle Transportation Management component in Oracle Supply Chain Products Suite 6.2, 6.3, 6.3.1, and 6.3.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Data, Domain & Function Security.
CVE-2014-0398 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the Oracle Application Object Library component in Oracle E-Business Suite 11.5.10.2, 12.0.6, 12.1.3, and 12.2.2 allows remote attackers to affect confidentiality via unknown vectors related to Discoverer.
CVE-2014-0396 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Portal - Web Services.
CVE-2014-0395 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0394.
CVE-2014-0394 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect confidentiality via unknown vectors related to Updates Environment Mgmt, a different vulnerability than CVE-2014-0395.
CVE-2014-0392 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise HRMS component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Security.
CVE-2014-0391 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.0, and 11.1.2.1 allows remote attackers to affect confidentiality via unknown vectors related to End User Self Service.
CVE-2014-0389 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in Oracle iLearning 6.0 allows remote attackers to affect integrity via unknown vectors related to Learner Pages.
CVE-2014-0388 Medium 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise HRMS Human Resources component in Oracle PeopleSoft Products 9.1 and 9.2 allows remote authenticated users to affect confidentiality via unknown vectors related to Org and Workforce Dev.
CVE-2014-0383 Low 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.2.0 and 11.1.2.1 allows remote authenticated users to affect confidentiality via unknown vectors related to Identity Console.
CVE-2014-0381 Low 2014-01-15 No exploit published No public exploit Unspecified vulnerability in the PeopleSoft Enterprise PeopleTools component in Oracle PeopleSoft Products 8.52 and 8.53 allows remote attackers to affect integrity via vectors related to PIA Core Technology, a different vulnerability than CVE-2014-0445.
‹ prev page 1 of 20 next ›