WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2005-04-01✕Published to 2005-06-30✕
Overview 17 matches · 2 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
17matches 2protected11.8% 0exploited0.0% 0CISA KEV0.0% 2public PoC11.8% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 11.8% Rule in development 0 0.0% Mitigation candidate 2 11.8% No exploit published 13 76.5%
Critical 1 5.9% High 3 17.6% Medium 13 76.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 11.8% partly blocked 0 0.0% not blocked 15 88.2% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 11.8% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 15 88.2%
split by peak 16 / month
No exploit published: 13Mitigation candidate: 2Protected by Waratek: 2 Medium: 13High: 3Critical: 1 not blocked: 15blocked by ARMR today: 2 No public exploit: 15Working exploit published: 2
May 0516 Protected by Waratek2 Mitigation candidate2 No exploit published12 Critical1 High2 Medium13 blocked by ARMR today2 not blocked14 Working exploit published2 No public exploit14 Jun 051 No exploit published1 High1 not blocked1 No public exploit1
May 05Jun 05
17 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2005-1872 High 2005-06-03 No exploit published No public exploit Buffer overflow in the administrative console in IBM WebSphere Application Server 5.x, when the global security option is enabled, allows remote attackers to execute arbitrary code.
CVE-2005-1748 Medium 2005-05-24 No exploit published No public exploit The embedded LDAP server in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 5, allows remote anonymous binds, which may allow remote attackers to view user entries or cause a denial of service.
CVE-2005-1747 Medium 2005-05-24 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in BEA WebLogic Server and Express 8.1 through Service Pack 4, and 7.0 through Service Pack 6, allow remote attackers to inject arbitrary web script or HTML, and possibly gain administrative privileges, via the (1) j_username or (2) j_password parameters in the login page (LoginForm.jsp), (3) parameters to the error page in the Administration Console, (4) unknown vectors in the Server Console while the administrator has an active session to obtain the ADMINCONSOLESESSION cookie, or (5) an alternate vector in the Server Console that does not require an active session but also leaks the username and password.
CVE-2005-1746 Medium 2005-05-24 No exploit published No public exploit The cluster cookie parsing code in BEA WebLogic Server 7.0 through Service Pack 5 attempts to contact any host or port specified in a cookie, even when it is not in the cluster, which allows remote attackers to cause a denial of service (cluster slowdown) via modified cookies.
CVE-2005-1745 Medium 2005-05-24 No exploit published No public exploit The UserLogin control in BEA WebLogic Portal 8.1 through Service Pack 3 prints the password to standard output when an incorrect login attempt is made, which could make it easier for attackers to guess the correct password.
CVE-2005-1744 Critical 2005-05-24 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.
CVE-2005-1743 High 2005-05-24 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 through Service Pack 3 and 7.0 through Service Pack 5 does not properly handle when a security provider throws an exception, which may cause WebLogic to use incorrect identity for the thread, or to fail to audit security exceptions.
CVE-2005-1742 Medium 2005-05-24 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 SP2 and SP3 allows users with the Monitor security role to "shrink or reset JDBC connection pools."
CVE-2005-1380 Medium 2005-05-03 Mitigation candidate Working exploit published Cross-site scripting (XSS) vulnerability in BEA Admin Console 8.1 allows remote attackers to execute arbitrary web script or HTML via the server parameter to a JndiFramesetAction action.
CVE-2005-1112 Medium 2005-05-02 Mitigation candidate Working exploit published IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine.
CVE-2005-1080 Medium 2005-05-02 Protected by Waratek No public exploit Directory traversal vulnerability in the Java Archive Tool (Jar) utility in J2SE SDK 1.4.2 and 1.5, and OpenJDK, allows remote attackers to create or overwrite arbitrary files via a .. (dot dot) in filenames in a .jar file.
CVE-2005-0836 High 2005-05-02 No exploit published No public exploit Argument injection vulnerability in Java Web Start for J2SE 1.4.2 up to 1.4.2_06 allows untrusted applications to gain privileges via the value parameter of a property tag in a JNLP file.
CVE-2005-0808 Medium 2005-05-02 No exploit published No public exploit Apache Tomcat before 5.x allows remote attackers to cause a denial of service (application crash) via a crafted AJP12 packet to TCP port 8007.
CVE-2005-0742 Medium 2005-05-02 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Sun Java System Application Server 7 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2005-0432 Medium 2005-05-02 No exploit published No public exploit BEA WebLogic Server 7.0 Service Pack 5 and earlier, and 8.1 Service Pack 3 and earlier, generates different login exceptions that suggest why an authentication attempt fails, which makes it easier for remote attackers to guess passwords via brute force attacks.
CVE-2005-0425 Medium 2005-05-02 No exploit published No public exploit Unknown vulnerability in IBM Websphere Application Server 5.0, 5.1, and 6.0 when running on Windows, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via a crafted URL that causes the page to be processed by the file serving servlet instead of the JSP engine.
CVE-2005-0223 Medium 2005-05-02 Protected by Waratek No public exploit The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang) via object deserialization.