WaratekVRT Sign in
Reset
More filters (1)
Columns
Published to 2006-08-31✕
Overview 26 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
26matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC3.8% 1EPSS ≥ 0.53.8%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 3.8% No exploit published 25 96.2%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 26 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 26 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 3.8% Proof of concept only 0 0.0% Forecast only 1 3.8% No public exploit 24 92.3%
split by peak 6 / quarter
No exploit published: 25Mitigation candidate: 1 Low: 26 not blocked: 26 No public exploit: 24Forecast only: 1Working exploit published: 1
Q3 021 No exploit published1 Low1 not blocked1 Forecast only1 Q4 022 No exploit published2 Low2 not blocked2 No public exploit2 Q1 030 Q2 030 Q3 030 Q4 036 Mitigation candidate1 No exploit published5 Low6 not blocked6 Working exploit published1 No public exploit5 Q1 041 No exploit published1 Low1 not blocked1 No public exploit1 Q2 040 Q3 041 No exploit published1 Low1 not blocked1 No public exploit1 Q4 041 No exploit published1 Low1 not blocked1 No public exploit1 Q1 050 Q2 050 Q3 051 No exploit published1 Low1 not blocked1 No public exploit1 Q4 054 No exploit published4 Low4 not blocked4 No public exploit4 Q1 064 No exploit published4 Low4 not blocked4 No public exploit4 Q2 063 No exploit published3 Low3 not blocked3 No public exploit3 Q3 062 No exploit published2 Low2 not blocked2 No public exploit2
Q3 02Q1 03Q3 03Q1 04Q3 04Q1 05Q3 05Q1 06Q3 06
26 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2006-3933 Low 2006-07-31 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Alkacon OpenCms before 6.2.2 allows remote authenticated users to inject arbitrary web script or HTML via the message body.
CVE-2006-3707 Low 2006-07-21 No exploit published No public exploit Unspecified vulnerability in OC4J for Oracle Application Server 9.0.2.3 and 9.0.3.1 has unknown impact and attack vectors, aka Oracle Vuln# AS02.
CVE-2006-3225 Low 2006-06-26 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Sun ONE Application Server 7 before Update 9, Java System Application Server 7 2004Q2 before Update 5, and Java System Application Server Enterprise Edition 8.1 2005 Q1 allows remote attackers to inject arbitrary HTML or web script via unknown vectors.
CVE-2006-2571 Low 2006-05-24 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in search.html in Alkacon OpenCms 6.0.0, 6.0.2, and 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the query parameter in a search action.
CVE-2006-2466 Low 2006-05-19 No exploit published No public exploit BEA WebLogic Server 8.1 up to SP4 and 7.0 up to SP6 allows remote attackers to obtain the source code of JSP pages during certain circumstances related to a "timing window" when a compilation error occurs, aka the "JSP showcode vulnerability."
CVE-2006-0432 Low 2006-01-25 No exploit published No public exploit Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0, when an Administrator uses the WebLogic Administration Console to add custom security policies, causes incorrect policies to be created, which prevents the server from properly protecting JNDI resources.
CVE-2006-0431 Low 2006-01-25 No exploit published No public exploit Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 8.1 SP5 allows untrusted applications to obtain the server's SSL identity via unknown attack vectors.
CVE-2006-0429 Low 2006-01-25 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 9.0 causes new security providers to appear active even if they have not been activated by a server reboot, which could cause an administrator to perform inappropriate, security-relevant actions.
CVE-2006-0427 Low 2006-01-25 No exploit published No public exploit Unspecified vulnerability in BEA WebLogic Server and WebLogic Express 9.0 and 8.1 through SP5 allows malicious EJBs or servlet applications to decrypt system passwords, possibly by accessing functionality that should have been restricted.
CVE-2005-4761 Low 2005-12-31 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 SP4 and earlier, 7.0 SP5 and earlier, and 6.1 SP7 and earlier log the Java command line at server startup, which might include sensitive information (passwords or keyphrases) in the server log file when the -D option is used.
CVE-2005-4755 Low 2005-12-31 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 8.1 SP3 and earlier (1) stores the private key passphrase (CustomTrustKeyStorePassPhrase) in cleartext in nodemanager.config; or, during domain creation with the Configuration Wizard, renders an SSL private key passphrase in cleartext (2) on a terminal or (3) in a log file, which might allow local users to obtain cryptographic keys.
CVE-2005-2527 Low 2005-12-31 No exploit published No public exploit Race condition in Java 1.4.2 before 1.4.2 Release 2 on Apple Mac OS X allows local users to corrupt files or create arbitrary files via unspecified attack vectors related to a temporary directory, possibly due to a symlink attack.
CVE-2005-3164 Low 2005-10-06 No exploit published No public exploit The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.
CVE-2005-2292 Low 2005-07-18 No exploit published No public exploit Oracle JDeveloper 9.0.4, 9.0.5, and 10.1.2 stores cleartext passwords in (1) IDEConnections.xml, (2) XSQLConfig.xml and (3) settings.xml, which allows local users to obtain sensitive information.
CVE-2004-2321 Low 2004-12-31 No exploit published No public exploit BEA WebLogic Server and Express 8.1 SP1 and earlier allows local users in the Operator role to obtain administrator passwords via MBean attributes, including (1) ServerStartMBean.Password and (2) NodeManagerMBean.CertificatePassword.
CVE-2004-0471 Low 2004-07-07 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 7.0 through SP5 and 8.1 through SP2 does not enforce site restrictions for starting and stopping servers for users in the Admin and Operator security roles, which allows unauthorized users to cause a denial of service (service shutdown).
CVE-2004-1877 Low 2004-03-30 No exploit published No public exploit The p_submit_url value in the sample login form in the Oracle 9i Application Server (9iAS) Single Sign-on Administrators Guide, Release 2(9.0.2) for Oracle SSO allows remote attackers to spoof the login page, which could allow users to inadvertently reveal their username and password.
CVE-2003-1447 Low 2003-12-31 No exploit published No public exploit IBM WebSphere Advanced Server Edition 4.0.4 uses a weak encryption algorithm (XOR and base64 encoding), which allows local users to decrypt passwords when the configuration file is exported to XML.
CVE-2003-1437 Low 2003-12-31 No exploit published No public exploit BEA WebLogic Express and WebLogic Server 7.0 and 7.0.0.1, stores passwords in plaintext when a keystore is used to store a private key or trust certificate authorities, which allows local users to gain access.
CVE-2003-1226 Low 2003-12-31 No exploit published No public exploit BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores certain secrets concerning password encryption insecurely in config.xml, filerealm.properties, and weblogic-rar.xml, which allows local users to learn those secrets and decrypt passwords.
CVE-2003-1225 Low 2003-12-31 No exploit published No public exploit The default CredentialMapper for BEA WebLogic Server and Express 7.0 and 7.0.0.1 stores passwords in cleartext on disk, which allows local users to extract passwords.
CVE-2003-1224 Low 2003-12-31 No exploit published No public exploit Weblogic.admin for BEA WebLogic Server and Express 7.0 and 7.0.0.1 displays the JDBCConnectionPoolRuntimeMBean password to the screen in cleartext, which allows attackers to read a user's password by physically observing ("shoulder surfing") the screen.
CVE-2003-1134 Low 2003-12-31 Mitigation candidate Working exploit published Sun Java 1.3.1, 1.4.1, and 1.4.2 allows local users to cause a denial of service (JVM crash), possibly by calling the ClassDepth function with a null parameter, which causes a crash instead of generating a null pointer exception.
CVE-2002-2177 Low 2002-12-31 No exploit published No public exploit BEA WebLogic Server and Express 6.1 through 7.0.0.1 buffers HTTP requests in a way that can cause BEA to send the same response for two different HTTP requests, which could allow remote attackers to obtain sensitive information that was intended for other users.
CVE-2002-1030 Low 2002-10-04 No exploit published No public exploit Race condition in Performance Pack in BEA WebLogic Server and Express 5.1.x, 6.0.x, 6.1.x and 7.0 allows remote attackers to cause a denial of service (crash) via a flood of data and connections.
CVE-2002-0568 Low 2002-07-03 No exploit published Forecast only Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.