WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2011-05-31✕Vendor apache✕
Overview 10 matches · 2 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
10matches 2protected20.0% 0exploited0.0% 0CISA KEV0.0% 3public PoC30.0% 1EPSS ≥ 0.510.0%
Protected by Waratek 2 20.0% Rule in development 0 0.0% Mitigation candidate 2 20.0% No exploit published 6 60.0%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 10 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 20.0% partly blocked 0 0.0% not blocked 8 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 30.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 7 70.0%
split by peak 2 / quarter
No exploit published: 6Mitigation candidate: 2Protected by Waratek: 2 Low: 10 not blocked: 8blocked by ARMR today: 2 No public exploit: 7Working exploit published: 3
Q4 051 No exploit published1 Low1 not blocked1 No public exploit1 Q1 060 Q2 060 Q3 060 Q4 060 Q1 070 Q2 072 No exploit published2 Low2 not blocked2 No public exploit2 Q3 070 Q4 071 Protected by Waratek1 Low1 blocked by ARMR today1 Working exploit published1 Q1 080 Q2 080 Q3 080 Q4 080 Q1 091 No exploit published1 Low1 not blocked1 No public exploit1 Q2 090 Q3 090 Q4 090 Q1 100 Q2 102 Mitigation candidate1 No exploit published1 Low2 not blocked2 Working exploit published1 No public exploit1 Q3 101 No exploit published1 Low1 not blocked1 No public exploit1 Q4 100 Q1 111 Protected by Waratek1 Low1 blocked by ARMR today1 No public exploit1 Q2 111 Mitigation candidate1 Low1 not blocked1 Working exploit published1
Q4 05Q2 06Q4 06Q2 07Q4 07Q2 08Q4 08Q2 09Q4 09Q2 10Q4 10Q2 11
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2011-1772 Low 2011-05-13 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.
CVE-2010-3718 Low 2011-02-10 Protected by Waratek No public exploit Apache Tomcat 7.0.0 through 7.0.3, 6.0.x, and 5.5.x, when running within a SecurityManager, does not make the ServletContext attribute read-only, which allows local web applications to read or write files outside of the intended working directory, as demonstrated using a directory traversal attack.
CVE-2009-4269 Low 2010-08-16 No exploit published No public exploit The password hash generation algorithm in the BUILTIN authentication functionality for Apache Derby before 10.6.1.0 performs a transformation that reduces the size of the set of inputs to SHA-1, which produces a small search space that makes it easier for local and possibly remote attackers to crack passwords by generating hash collisions, related to password substitution.
CVE-2010-1157 Low 2010-04-23 Mitigation candidate Working exploit published Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.
CVE-2010-0684 Low 2010-04-05 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in createDestination.action in Apache ActiveMQ before 5.3.1 allows remote authenticated users to inject arbitrary web script or HTML via the JMSDestination parameter in a queue action.
CVE-2008-4308 Low 2009-02-26 No exploit published No public exploit The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request.
CVE-2007-5461 Low 2007-10-15 Protected by Waratek Working exploit published Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
CVE-2007-2450 Low 2007-06-14 No exploit published No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the (1) Manager and (2) Host Manager web applications in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote authenticated users to inject arbitrary web script or HTML via a parameter name to manager/html/upload, and other unspecified vectors.
CVE-2007-1358 Low 2007-05-10 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in certain applications using Apache Tomcat 4.0.0 through 4.0.6 and 4.1.0 through 4.1.34 allows remote attackers to inject arbitrary web script or HTML via crafted "Accept-Language headers that do not conform to RFC 2616".
CVE-2005-3164 Low 2005-10-06 No exploit published No public exploit The AJP connector in Apache Tomcat 4.0.1 through 4.0.6 and 4.1.0 through 4.1.36, as used in Hitachi Cosminexus Application Server and standalone, does not properly handle when a connection is broken before request body data is sent in a POST request, which can lead to an information leak when "unsuitable request body data" is used for a different request, possibly related to Java Servlet pages.