WaratekVRT Sign in
Reset
More filters (1)
Columns
Vendor ibm✕
Overview 15 matches · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
15matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 15 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 15 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 15 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 15 100.0%
split by peak 2 / year
Protected by Waratek: 15 Medium: 15 blocked by ARMR today: 15 No public exploit: 15
20111 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20121 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20131 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20142 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20150 20160 20170 20182 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20192 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20202 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20211 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20220 20230 20242 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20250 20261 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
20122014201620182020202220242026
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-10571 Medium 2026-08-13 Protected by Waratek No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled.
CVE-2024-45086 Medium 2024-11-04 Protected by Waratek No public exploit IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
CVE-2024-45072 Medium 2024-10-16 Protected by Waratek No public exploit IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources.
CVE-2020-5016 Medium 2021-03-10 Protected by Waratek No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. When application security is disabled and JAX-RPC applications are present, an attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary xml files on the system. This does not occur if Application security is enabled. IBM X-Force ID: 193556.
CVE-2020-4782 Medium 2020-10-28 Protected by Waratek No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVE-2020-4575 Medium 2020-08-27 Protected by Waratek No public exploit IBM WebSphere Application Server ND 8.5 and 9.0, and IBM WebSphere Virtual Enterprise 7.0 and 8.0 are vulnerable to cross-site scripting when High Availability Deployment Manager is configured.
CVE-2019-4442 Medium 2019-09-17 Protected by Waratek No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9,0 could allow a remote attacker to traverse directories on the file system. An attacker could send a specially-crafted URL request to view arbitrary files on the system but not content. IBM X-Force ID: 163226.
CVE-2019-4268 Medium 2019-09-17 Protected by Waratek No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 160201.
CVE-2018-1797 Medium 2018-11-16 Protected by Waratek No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 using Enterprise bundle Archives (EBA) could allow a local attacker to traverse directories on the system. By persuading a victim to extract a specially-crafted ZIP archive containing "dot dot slash" sequences (../), an attacker could exploit this vulnerability to write to arbitrary files on the system. Note: This vulnerability is known as "Zip-Slip". IBM X-Force ID: 149427.
CVE-2018-1770 Medium 2018-10-12 Protected by Waratek No public exploit IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 148686.
CVE-2014-6166 Medium 2014-12-18 Protected by Waratek No public exploit The Communications Enabled Applications (CEA) service in IBM WebSphere Application Server 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.4, and Feature Pack for CEA 1.x before 1.0.0.15, allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2014-3087 Medium 2014-08-17 Protected by Waratek No public exploit callService.do in IBM Business Process Manager (BPM) 7.5 through 8.5.5 and WebSphere Lombardi Edition 7.2 through 7.2.0.5 allows remote authenticated users to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2013-0544 Medium 2013-04-24 Protected by Waratek No public exploit Directory traversal vulnerability in the Administrative Console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.29, 8.0 before 8.0.0.6, and 8.5 before 8.5.0.2 on Linux and UNIX allows remote authenticated users to modify data via unspecified vectors.
CVE-2012-3305 Medium 2012-09-25 Protected by Waratek No public exploit Directory traversal vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to overwrite arbitrary files via a crafted application file.
CVE-2011-1359 Medium 2011-09-06 Protected by Waratek No public exploit Directory traversal vulnerability in the administration console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41, 7.0 before 7.0.0.19, and 8.0 before 8.0.0.1 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.