Overview 47 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 12 public PoC · 0 EPSS ≥ 0.5
47matches
2in Waratek scope4.3%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
12public PoC25.5%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
4.3%
Outside Waratek scope
1
2.1%
Not applicable
44
93.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
47
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
12
25.5%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
35
74.5%
split by
peak 10 / year
19962
No exploit published1
Not applicable1
High2
not blocked2
Working exploit published1
No public exploit1
19971
Not applicable1
High1
not blocked1
No public exploit1
19984
Not applicable4
High4
not blocked4
Working exploit published2
No public exploit2
19995
No exploit published1
Not applicable4
High5
not blocked5
No public exploit5
200010
Not applicable10
High10
not blocked10
Working exploit published5
No public exploit5
20015
Not applicable5
High5
not blocked5
Working exploit published2
No public exploit3
20027
Not applicable7
High7
not blocked7
No public exploit7
20031
Not applicable1
High1
not blocked1
No public exploit1
20045
Outside Waratek scope1
Not applicable4
High5
not blocked5
Working exploit published1
No public exploit4
20053
Not applicable3
High3
not blocked3
No public exploit3
20061
Not applicable1
High1
not blocked1
Working exploit published1
20072
Not applicable2
High2
not blocked2
No public exploit2
20081
Not applicable1
High1
not blocked1
No public exploit1
1996199820002002200420062008
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2008-1676 | High | 2008-07-07 | Not applicable | No public exploit | Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate. |
| CVE-2007-4042 | High | 2007-07-27 | Not applicable | No public exploit | Multiple argument injection vulnerabilities in Netscape Navigator 9 allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670. |
| CVE-2007-3924 | High | 2007-07-21 | Not applicable | No public exploit | Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Netscape installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a -chrome argument to the navigatorurl URI, which are inserted into the command line that is created when invoking netscape.exe, a related issue to CVE-2007-3670. NOTE: there has been debate about whether the issue is in Internet Explorer or Netscape. As of 20070713, it is CVE's opinion that IE appears to not properly delimit the URL argument when invoking Netscape; this issue could arise with other protocol handlers in IE. |
| CVE-2006-4253 | High | 2006-08-21 | Not applicable | Working exploit published | Concurrency vulnerability in Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via multiple Javascript timed events that load a deeply nested XML file, followed by redirecting the browser to another page, which leads to a concurrency failure that causes structures to be freed incorrectly, as demonstrated by (1) ffoxdie and (2) ffoxdie3. NOTE: it has been reported that Netscape 8.1 and K-Meleon 1.0.1 are also affected by ffoxdie. Mozilla confirmed to CVE that ffoxdie and ffoxdie3 trigger the same underlying vulnerability. NOTE: it was later reported that Firefox 2.0 RC2 and 1.5.0.7 are also affected. |
| CVE-2005-1157 | High | 2005-05-02 | Not applicable | No public exploit | Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to replace existing search plugins with malicious ones using sidebar.addSearchEngine and the same filename as the target engine, which may not be displayed in the GUI, which could then be used to execute malicious script, aka "Firesearching 2." |
| CVE-2005-1156 | High | 2005-05-02 | Not applicable | No public exploit | Firefox before 1.0.3, Mozilla Suite before 1.7.7, and Netscape 7.2 allows remote attackers to execute arbitrary script and code via a new search plugin using sidebar.addSearchEngine, aka "Firesearching 1." |
| CVE-2004-1160 | High | 2005-01-10 | Not applicable | No public exploit | Netscape 7.x to 7.2, and possibly other versions, allows remote attackers to spoof arbitrary web sites by injecting content from one window into a target window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. |
| CVE-2004-1236 | High | 2004-12-31 | Not applicable | No public exploit | Buffer overflow in the LDAP component for Netscape Directory Server (NDS) 3.6 on HP-UX and other operating systems allows remote attackers to execute arbitrary code. |
| CVE-2004-0904 | High | 2004-12-31 | Not applicable | No public exploit | Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to execute arbitrary code via wide bitmap files that trigger heap-based buffer overflows. |
| CVE-2004-0826 | High | 2004-12-31 | Outside Waratek scope | No public exploit | Heap-based buffer overflow in Netscape Network Security Services (NSS) library allows remote attackers to execute arbitrary code via a modified record length field in an SSLv2 client hello message. |
| CVE-2004-0722 | High | 2004-08-18 | Not applicable | Working exploit published | Integer overflow in the SOAPParameter object constructor in (1) Netscape version 7.0 and 7.1 and (2) Mozilla 1.6, and possibly earlier versions, allows remote attackers to execute arbitrary code. |
| CVE-2004-0718 | High | 2004-07-27 | Not applicable | No public exploit | The (1) Mozilla 1.6, (2) Firebird 0.7, (3) Firefox 0.8, and (4) Netscape 7.1 web browsers do not properly prevent a frame in one domain from injecting content into a frame that belongs to another domain, which facilitates web site spoofing and other attacks, aka the frame injection vulnerability. |
| CVE-2003-0553 | High | 2003-08-18 | Not applicable | No public exploit | Buffer overflow in the Client Detection Tool (CDT) plugin (npcdt.dll) for Netscape 7.02 allows remote attackers to execute arbitrary code via an attachment with a long filename. |
| CVE-2002-2248 | High | 2002-12-31 | Not applicable | No public exploit | Buffer overflow in the sun.awt.windows.WDefaultFontCharset Java class implementation in Netscape 4.0 allows remote attackers to execute arbitrary code via an applet that calls the WDefaultFontCharset constructor with a long string and invokes the canConvert method. |
| CVE-2002-2061 | High | 2002-12-31 | Not applicable | No public exploit | Heap-based buffer overflow in Netscape 6.2.3 and Mozilla 1.0 and earlier allows remote attackers to crash client browsers and execute arbitrary code via a PNG image with large width and height values and an 8-bit or 16-bit alpha channel. |
| CVE-2002-1654 | High | 2002-12-31 | Not applicable | No public exploit | iPlanet Web Server Enterprise Edition and Netscape Enterprise Server 4.0 and 4.1 allows remote attackers to conduct HTTP Basic Authentication via the wp-force-auth Web Publisher command, which provides a distinct attack vector and may make it easier to conduct brute force password guessing without detection. |
| CVE-2002-1308 | High | 2002-11-29 | Not applicable | No public exploit | Heap-based buffer overflow in Netscape and Mozilla allows remote attackers to execute arbitrary code via a jar: URL that references a malformed .jar file, which overflows a buffer during decompression. |
| CVE-2002-1091 | High | 2002-10-04 | Not applicable | No public exploit | Netscape 6.2.3 and earlier, and Mozilla 1.0.1, allow remote attackers to corrupt heap memory and execute arbitrary code via a GIF image with a zero width. |
| CVE-2002-0815 | High | 2002-08-12 | Not applicable | No public exploit | The Javascript "Same Origin Policy" (SOP), as implemented in (1) Netscape, (2) Mozilla, and (3) Internet Explorer, allows a remote web server to access HTTP and SOAP/XML content from restricted sites by mapping the malicious server's parent DNS domain name to the restricted site, loading a page from the restricted site into one frame, and passing the information to the attacker-controlled frame, which is allowed because the document.domain of the two frames matches on the parent domain. |
| CVE-2002-0593 | High | 2002-06-18 | Not applicable | No public exploit | Buffer overflow in Netscape 6 and Mozilla 1.0 RC1 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long channel name in an IRC URI. |
| CVE-2001-0596 | High | 2001-08-02 | Not applicable | Working exploit published | Netscape Communicator before 4.77 allows remote attackers to execute arbitrary Javascript via a GIF image whose comment contains the Javascript. |
| CVE-2001-0262 | High | 2001-07-02 | Not applicable | Working exploit published | Buffer overflow in Netscape SmartDownload 1.3 allows remote attackers (malicious web pages) to execute arbitrary commands via a long URL. |
| CVE-2001-0164 | High | 2001-06-02 | Not applicable | No public exploit | Buffer overflow in Netscape Directory Server 4.12 and earlier allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed recipient field. |
| CVE-2000-0308 | High | 2001-03-12 | Not applicable | No public exploit | Insecure file permissions for Netscape FastTrack Server 2.x, Enterprise Server 2.0, and Proxy Server 2.5 in SCO UnixWare 7.0.x and 2.1.3 allow an attacker to gain root privileges. |
| CVE-2000-1187 | High | 2001-01-09 | Not applicable | No public exploit | Buffer overflow in the HTML parser for Netscape 4.75 and earlier allows remote attackers to execute arbitrary commands via a long password value in a form field. |
| CVE-2000-0961 | High | 2000-12-19 | Not applicable | No public exploit | Buffer overflow in IMAP server in Netscape Messaging Server 4.15 Patch 2 allows local users to execute arbitrary commands via a long LIST command. |
| CVE-2000-1076 | High | 2000-12-11 | Not applicable | No public exploit | Netscape (iPlanet) Certificate Management System 4.2 and Directory Server 4.12 stores the administrative password in plaintext, which could allow local and possibly remote attackers to gain administrative privileges on the server. |
| CVE-2000-1074 | High | 2000-12-11 | Not applicable | Working exploit published | csstart program in iCal 2.1 Patch 2 uses relative pathnames to install the libsocket and libnsl libraries, which could allow the icsuser account to gain root privileges by creating a Trojan Horse library in the current or parent directory. |
| CVE-2000-1073 | High | 2000-12-11 | Not applicable | No public exploit | csstart program in iCal 2.1 Patch 2 searches for the cshttpd program in the current working directory, which allows local users to gain root privileges by creating a Trojan Horse cshttpd program in a directory and calling csstart from that directory. |
| CVE-2000-1072 | High | 2000-12-11 | Not applicable | Working exploit published | iCal 2.1 Patch 2 installs many files with world-writeable permissions, which allows local users to modify the iCal configuration and execute arbitrary commands by replacing the iplncal.sh program with a Trojan horse. |
| CVE-2000-1071 | High | 2000-12-11 | Not applicable | No public exploit | The GUI installation for iCal 2.1 Patch 2 disables access control for the X server using an "xhost +" command, which allows remote attackers to monitor X Windows events and gain privileges. |
| CVE-2000-0711 | High | 2000-10-20 | Not applicable | Working exploit published | Netscape Communicator does not properly prevent a ServerSocket object from being created by untrusted entities, which allows remote attackers to create a server on the victim's system via a malicious applet, as demonstrated by Brown Orifice. |
| CVE-2000-0600 | High | 2000-06-26 | Not applicable | No public exploit | Netscape Enterprise Server in NetWare 5.1 allows remote attackers to cause a denial of service or execute arbitrary commands via a malformed URL. |
| CVE-2000-0577 | High | 2000-06-21 | Not applicable | Working exploit published | Netscape Professional Services FTP Server 1.3.6 allows remote attackers to read arbitrary files via a .. (dot dot) attack. |
| CVE-1999-0744 | High | 2000-01-04 | Not applicable | Working exploit published | Buffer overflow in Netscape Enterprise Server and FastTrask Server allows remote attackers to gain privileges via a long HTTP GET request. |
| CVE-1999-0853 | High | 1999-12-01 | Not applicable | No public exploit | Buffer overflow in Netscape Enterprise Server and Netscape FastTrack Server allows remote attackers to gain privileges via the HTTP Basic Authentication procedure. |
| CVE-1999-1189 | High | 1999-11-24 | Not applicable | No public exploit | Buffer overflow in Netscape Navigator/Communicator 4.7 for Windows 95 and Windows 98 allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long argument after the ? character in a URL that references an .asp, .cgi, .html, or .pl file. |
| CVE-1999-1357 | High | 1999-10-05 | Not applicable | No public exploit | Netscape Communicator 4.04 through 4.7 (and possibly other versions) in various UNIX operating systems converts the 0x8b character to a "<" sign, and the 0x9b character to a ">" sign, which could allow remote attackers to attack other clients via cross-site scripting (CSS) in CGI programs that do not filter these characters. |
| CVE-1999-0807 | High | 1999-05-01 | Not applicable | No public exploit | The Netscape Directory Server installation procedure leaves sensitive information in a file that is accessible to local users. |
| CVE-1999-0440 | High | 1999-03-01 | No exploit published | No public exploit | The byte code verifier component of the Java Virtual Machine (JVM) allows remote execution through malicious web pages. |
| CVE-1999-0005 | High | 1998-07-20 | Not applicable | Working exploit published | Arbitrary command execution via IMAP buffer overflow in authenticate command. |
| CVE-1999-0537 | High | 1998-04-01 | Not applicable | No public exploit | A configuration in a web browser such as Internet Explorer or Netscape Navigator allows execution of active content such as ActiveX, Java, Javascript, etc. |
| CVE-1999-0012 | High | 1998-02-06 | Not applicable | No public exploit | Some web servers under Microsoft Windows allow remote attackers to bypass access restrictions for files with long file names. |
| CVE-1999-0239 | High | 1998-01-01 | Not applicable | Working exploit published | Netscape FastTrack Web server lists files when a lowercase "get" command is used instead of an uppercase GET. |
| CVE-1999-0868 | High | 1997-02-20 | Not applicable | No public exploit | ucbmail allows remote attackers to execute commands via shell metacharacters that are passed to it from INN. |
| CVE-1999-0045 | High | 1996-12-10 | Not applicable | Working exploit published | List of arbitrary files on Web host via nph-test-cgi script. |
| CVE-1999-0142 | High | 1996-03-01 | No exploit published | No public exploit | The Java Applet Security Manager implementation in Netscape Navigator 2.0 and Java Developer's Kit 1.0 allows an applet to connect to arbitrary hosts. |