WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2004-01-01✕Published to 2004-12-31✕
Overview 27 matches · 2 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
27matches 2protected7.4% 0exploited0.0% 0CISA KEV0.0% 1public PoC3.7% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 7.4% Rule in development 0 0.0% Mitigation candidate 1 3.7% No exploit published 24 88.9%
Critical 0 0.0% High 6 22.2% Medium 18 66.7% Low 3 11.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 7.4% partly blocked 0 0.0% not blocked 25 92.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 3.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 26 96.3%
split by peak 11 / month
No exploit published: 24Mitigation candidate: 1Protected by Waratek: 2 Low: 3Medium: 18High: 6 not blocked: 25blocked by ARMR today: 2 No public exploit: 26Working exploit published: 1
Jan 041 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Feb 040 Mar 041 No exploit published1 Low1 not blocked1 No public exploit1 Apr 042 No exploit published2 Medium2 not blocked2 No public exploit2 May 040 Jun 041 No exploit published1 High1 not blocked1 No public exploit1 Jul 046 No exploit published6 High2 Medium3 Low1 not blocked6 No public exploit6 Aug 045 Protected by Waratek1 No exploit published4 High3 Medium2 blocked by ARMR today1 not blocked4 No public exploit5 Sep 040 Oct 040 Nov 040 Dec 0411 Protected by Waratek1 No exploit published10 Medium10 Low1 blocked by ARMR today1 not blocked10 No public exploit11
Jan 04Feb 04Mar 04Apr 04May 04Jun 04Jul 04Aug 04Sep 04Oct 04Nov 04Dec 04
27 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2004-2696 Medium 2004-12-31 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 6.1, 7.0, and 8.1, when using Remote Method Invocation (RMI) over Internet Inter-ORB Protocol (IIOP), does not properly handle when multiple logins for different users coming from the same client, which could cause an "unexpected user identity" to be used in an RMI call.
CVE-2004-2650 Medium 2004-12-31 No exploit published No public exploit Spooler in Apache Foundation James 2.2.0 allows local users to cause a denial of service (memory consumption) by triggering various error conditions in the retrieve function, which prevents a lock from being released and causes a memory leak.
CVE-2004-2540 Medium 2004-12-31 No exploit published No public exploit readObject in (1) Java Runtime Environment (JRE) and (2) Software Development Kit (SDK) 1.4.0 through 1.4.2_05 allows remote attackers to cause a denial of service (JVM unresponsive) via crafted serialized data.
CVE-2004-2424 Medium 2004-12-31 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 through 8.1 SP2 allow remote attackers to cause a denial of service (network port consumption) via unknown actions in HTTPS sessions, which prevents the server from releasing the network port when the session ends.
CVE-2004-2381 Medium 2004-12-31 No exploit published No public exploit HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length.
CVE-2004-2321 Low 2004-12-31 No exploit published No public exploit BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword.
CVE-2004-2320 Medium 2004-12-31 Protected by Waratek No public exploit The default configuration of BEA WebLogic Server and Express 8.1 SP2 and earlier, 7.0 SP4 and earlier, 6.1 through SP6, and 5.1 through SP13 responds to the HTTP TRACE request, which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting.
CVE-2004-2244 Medium 2004-12-31 No exploit published No public exploit The XML parser in Oracle 9i Application Server Release 2 9.0.3.0 and 9.0.3.1, 9.0.2.3 and earlier, and Release 1 1.0.2.2 and 1.0.2.2.2, and Database Server Release 2 9.2.0.1 and later, allows remote attackers to cause a denial of service (CPU and memory consumption) via a SOAP message containing a crafted DTD.
CVE-2004-2216 Medium 2004-12-31 No exploit published No public exploit Unknown vulnerability in Sun Java System Web Server 6.0 SP7 and earlier and 6.1 SP1 and earlier, and Application Server 7 Update 4 and earlier, allows remote attackers to cause a denial of service (crash) via a malformed client certificate.
CVE-2004-1757 Medium 2004-12-31 No exploit published No public exploit BEA WebLogic Server and Express 8.1, SP1 and earlier, stores the administrator password in cleartext in config.xml, which allows local users to gain privileges.
CVE-2004-1503 Medium 2004-12-31 No exploit published No public exploit Integer overflow in the InitialDirContext in Java Runtime Environment (JRE) 1.4.2, 1.5.0 and possibly other versions allows remote attackers to cause a denial of service (Java exception and failed DNS requests) via a large number of DNS requests, which causes the xid variable to wrap around and become negative.
CVE-2004-0652 High 2004-08-06 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 7.0 through 7.0 Service Pack 4, and 8.1 through 8.1 Service Pack 2, allows attackers to obtain the username and password for booting the server by directly accessing certain internal methods.
CVE-2004-0651 Medium 2004-08-06 No exploit published No public exploit Unknown vulnerability in Sun Java Runtime Environment (JRE) 1.4.2 through 1.4.2_03 allows remote attackers to cause a denial of service (virtual machine hang).
CVE-2004-0543 High 2004-08-06 Protected by Waratek No public exploit Multiple SQL injection vulnerabilities in Oracle Applications 11.0 and Oracle E-Business Suite 11.5.1 through 11.5.8 allow remote attackers to execute arbitrary SQL procedures and queries.
CVE-2004-1368 High 2004-08-04 No exploit published No public exploit ISQL*Plus in Oracle 10g Application Server allows remote attackers to execute arbitrary files via an absolute pathname in the file parameter to the load.uix script.
CVE-2004-1366 Medium 2004-08-04 No exploit published No public exploit Oracle 10g Database Server stores the password for the SYSMAN account in cleartext in the world-readable emoms.properties file, which could allow local users to gain DBA privileges.
CVE-2004-0715 Medium 2004-07-27 No exploit published No public exploit The WebLogic Authentication provider for BEA WebLogic Server and WebLogic Express 8.1 through SP2 and 7.0 through SP4 does not properly clear member relationships when a group is deleted, which can cause a new group with the same name to have the members of the old group, which allows group members to gain privileges.
CVE-2004-0713 Medium 2004-07-27 No exploit published No public exploit The remove method in a stateful Enterprise JavaBean (EJB) in BEA WebLogic Server and WebLogic Express version 8.1 through SP2, 7.0 through SP4, and 6.1 through SP6, does not properly check EJB permissions before unexporting a bean, which allows remote authenticated users to remove EJB objects from remote views before the security exception is thrown.
CVE-2004-0712 Medium 2004-07-27 No exploit published No public exploit The configuration tools (1) config.sh in Unix or (2) config.cmd in Windows for BEA WebLogic Server 8.1 through SP2 create a log file that contains the administrative username and password in cleartext, which could allow local users to gain privileges.
CVE-2004-0711 High 2004-07-27 No exploit published No public exploit The URL pattern matching feature in BEA WebLogic Server 6.x matches illegal patterns ending in "*" as wildcards as if they were the legal "/*" pattern, which could cause WebLogic 7.x to allow remote attackers to bypass intended access restrictions because the illegal patterns are properly rejected.
CVE-2004-0471 Low 2004-07-07 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown).
CVE-2004-0470 High 2004-07-07 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2, when editing weblogic.xml using WebLogic Builder or the SecurityRoleAssignmentMBean.toXML method, inadvertently removes security-role-assignment tags when weblogic.xml does not have a principal-name tag, which can remove intended access restrictions for the associated web application.
CVE-2004-0038 High 2004-06-14 No exploit published No public exploit McAfee ePolicy Orchestrator (ePO) 2.5.1 Patch 13 and 3.0 SP2a Patch 3 allows remote attackers to execute arbitrary commands via certain HTTP POST requests to the spipe/file handler on ePO TCP port 81.
CVE-2004-1758 Medium 2004-04-13 No exploit published No public exploit BEA WebLogic Server and WebLogic Express version 8.1 up to SP2, 7.0 up to SP4, and 6.1 up to SP6 may store the database username and password for an untargeted JDBC connection pool in plaintext in config.xml, which allows local users to gain privileges.
CVE-2004-1756 Medium 2004-04-13 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 SP2 and earlier, and 7.0 SP4 and earlier, when using 2-way SSL with a custom trust manager, may accept a certificate chain even if the trust manager rejects it, which allows remote attackers to spoof other users or servers.
CVE-2004-1877 Low 2004-03-30 No exploit published No public exploit The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password.
CVE-2004-2134 Medium 2004-01-28 Mitigation candidate Working exploit published Oracle toplink mapping workBench uses a weak encryption algorithm for passwords, which allows local users to decrypt the passwords.