WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor businessobjects✕
Overview 6 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
6matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 3public PoC50.0% 2EPSS ≥ 0.533.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 16.7% Not applicable 5 83.3% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 6 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 6 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 50.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 50.0%
split by peak 2 / year
Not applicable: 5Outside Waratek scope: 1 High: 6 not blocked: 6 No public exploit: 3Working exploit published: 3
20011 Not applicable1 High1 not blocked1 No public exploit1 20020 20031 Not applicable1 High1 not blocked1 No public exploit1 20041 Outside Waratek scope1 High1 not blocked1 Working exploit published1 20050 20062 Not applicable2 High2 not blocked2 Working exploit published1 No public exploit1 20070 20081 Not applicable1 High1 not blocked1 Working exploit published1
20012002200320042005200620072008
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2008-0379 High 2008-01-22 Not applicable Working exploit published Race condition in the Enterprise Tree ActiveX control (EnterpriseControls.dll 11.5.0.313) in Crystal Reports XI Release 2 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via the SelectedSession method, which triggers a buffer overflow.
CVE-2006-4099 High 2006-11-29 Not applicable No public exploit Business Objects Crystal Enterprise 9 and 10 generates predictable session identifiers, which allows remote attackers to hijack sessions of other users via WCSID cookie values.
CVE-2006-6133 High 2006-11-28 Not applicable Working exploit published Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal Reports XI Professional) allows user-assisted remote attackers to execute arbitrary code via a crafted RPT file.
CVE-2004-0204 High 2004-08-06 Outside Waratek scope Working exploit published Directory traversal vulnerability in the web viewers for Business Objects Crystal Reports 9 and 10, and Crystal Enterprise 9 or 10, as used in Visual Studio .NET 2003 and Outlook 2003 with Business Contact Manager, Microsoft Business Solutions CRM 1.2, and other products, allows remote attackers to read and delete arbitrary files via ".." sequences in the dynamicimag argument to crystalimagehandler.aspx.
CVE-2003-1249 High 2003-12-31 Not applicable No public exploit WebIntelligence 2.7.1 uses guessable user session cookies, which allows remote attackers to hijack sessions.
CVE-2001-1464 High 2001-01-10 Not applicable No public exploit Crystal Reports, when displaying data for a password protected database using HTML pages, embeds the username and password in cleartext in the HTML page and the URL, which allows remote attackers to obtain passwords.