[
  {"cve_id":"CVE-2026-76904","description":"GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(\u003ccolumn\u003e, \u003cpointer\u003e, \u003cvalue\u003e)` function writes `\u003cvalue\u003e` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.","exploit_maturity":"Working exploit published","published":"2026-08-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-18963","description":"A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.","exploit_maturity":"Working exploit published","published":"2026-08-18","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2026-44596","description":"Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.","exploit_maturity":"Working exploit published","published":"2026-07-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2026-44595","description":"Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the required SystemPrivilege.ControlAccess check in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java, so any authenticated user, even one with low or no privileges, could enumerate all user accounts in the system including their usernames, superuser status, and group memberships. This issue is fixed in versions 5.12.7 and 5.13.0.","exploit_maturity":"Working exploit published","published":"2026-07-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2026-41042","description":"Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino.\n\nThis issue affects Apache Gravitino: before 1.2.1.\n\nUsers are recommended to upgrade to version 1.2.1, which fixes the issue.\n\nThis issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.","exploit_maturity":"Working exploit published","published":"2026-07-08","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2026-50229","description":"Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in the number guess example for Apache Tomcat.\n\nThis issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other versions that have reached end of support may also be affected.\n\nUsers are recommended to upgrade to version 11.0.23, 10.1.56 or 9.0.119, which fix the issue.","exploit_maturity":"Working exploit published","published":"2026-06-29","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2026-42568","description":"Yamcs is a mission control framework. Prior to versions 5.13.0 and 5.12.7, an LDAP injection vulnerability exists in `org.yamcs.security.LdapAuthModule` when constructing search filters. The username parameter is inserted directly into the LDAP filter without proper RFC 4515 escaping. Versions 5.13.0 and 5.12.7 patch the issue.","exploit_maturity":"Working exploit published","published":"2026-06-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2026-44825","description":"Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster via publicly known default credentials installed silently alongside the user-specified account. \n\nAs an immediate workaround without upgrading, delete the template users (superadmin, admin, search, index) from security.json or change their passwords.\nThe future, not yet released, versions 9.11.0 and 10.1.0 will not be vulnerable, and it will be enough to upgrade to solve the issue.\n\nNot affected:\n  *  Clusters where bin/solr auth enable was not used to bootstrap BasicAuth\n  *  Clusters where template users have been assigned strong passwords after bootstrap","exploit_maturity":"Working exploit published","published":"2026-06-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-42344","description":"Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on a Chemistry servlet.","exploit_maturity":"Working exploit published","published":"2026-05-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-42343","description":"A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.","exploit_maturity":"Working exploit published","published":"2026-05-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2026-33453","description":"Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component.\n\nApache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code execution when routes forward CoAP requests to header-sensitive producers (e.g. camel-exec)\n\nThe camel-coap component maps incoming CoAP request URI query parameters directly into Camel Exchange In message headers without applying any HeaderFilterStrategy.    \nSpecifically, CamelCoapResource.handleRequest() iterates over OptionSet.getUriQuery() and calls camelExchange.getIn().setHeader(...) for every query parameter. CoAPEndpoint extends DefaultEndpoint rather than DefaultHeaderFilterStrategyEndpoint, and CoAPComponent does not implement HeaderFilterStrategyComponent; the component contains no references to HeaderFilterStrategy at all.\n\nAs a result, an unauthenticated attacker who can send a single CoAP UDP packet to a Camel route consuming from coap:// can inject arbitrary Camel internal headers (those prefixed with Camel*) into the Exchange. When the route delivers the message to a header-sensitive producer such as camel-exec, camel-sql, camel-bean, camel-file, or template components (camel-freemarker, camel-velocity), the injected headers can alter the producer's behavior. In the case of camel-exec, the CamelExecCommandExecutable and CamelExecCommandArgs headers override the executable and arguments configured on the endpoint, resulting in arbitrary OS command execution under the privileges of the Camel process.\n\nThe producer's output is written back to the Exchange body and returned in the CoAP response payload by CamelCoapResource, giving the attacker an interactive RCE channel without any need for out-of-band exfiltration.\n                                                                                                                                                                         \nExploitation prerequisites are minimal: a single unauthenticated UDP datagram to the CoAP port (default 5683). CoAP (RFC 7252) has no built-in authentication, and DTLS is optional and disabled by default. Because the protocol is UDP-based, HTTP-layer WAF/IDS controls do not apply.\nThis issue affects Apache Camel: from 4.14.0 through 4.14.5, from 4.18.0 before 4.18.1, 4.19.0.\n\nUsers are recommended to upgrade to version 4.18.1 or 4.19.0, fixing the issue.","exploit_maturity":"Working exploit published","published":"2026-04-27","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2026-40466","description":"Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ.\n\n\n\nAn authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath.\nA malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext.\nBecause Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec().\n\n\nThis issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5.\n\nUsers are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2026-04-24","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2026-40105","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through  16.10.15, 17.0.0-rc-1, through 17.4.7 and 17.5.0-rc-1 through 17.10.0 contain a reflected cross-site scripting vulnerability (XSS) in the comparison view between revisions of a page allows executing JavaScript code in the user's browser. If the current user is an admin, this can not only affect the current user but also the confidentiality, integrity and availability of the whole XWiki instance. If developers are unable to update immediately, they can apply the patch manually to templates/changesdoc.vm in the deployed WAR.","exploit_maturity":"Working exploit published","published":"2026-04-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2026-33439","description":"Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypasses the WhitelistObjectInputStream mitigation that was applied to the jato.pageSession parameter after CVE-2021-35464. An unauthenticated attacker can achieve arbitrary command execution on the server by sending a crafted serialized Java object as the jato.clientSession GET/POST parameter to any JATO ViewBean endpoint whose JSP contains \u003cjato:form\u003e tags (e.g., the Password Reset pages). This vulnerability is fixed in 16.0.6.","exploit_maturity":"Working exploit published","published":"2026-04-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2026-22739","description":"Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.","exploit_maturity":"Working exploit published","published":"2026-03-24","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2026-24128","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 7.0-milestone-2 through 16.10.11, 17.0.0-rc-1 through 17.4.4, and 17.5.0-rc-1 through 17.7.0 contain a reflected Cross-site Scripting (XSS) vulnerability, which allows an attacker to craft a malicious URL and execute arbitrary actions with the same privileges as the victim. If the victim has administrative or programming rights, those rights can be exploited to gain full access to the XWiki installation. This issue has been patched in versions 17.8.0-rc-1, 17.4.5 and 16.10.12. To workaround, the patch can be applied manually, only a single line in templates/logging_macros.vm needs to be changed, no restart is required.","exploit_maturity":"Working exploit published","published":"2026-01-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-68493","description":"Missing XML Validation vulnerability in Apache Struts, Apache Struts.\n\nThis issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0.\n\nUsers are recommended to upgrade to version 6.1.1, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2026-01-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-66472","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc-1 through  17.4.1 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates are vulnerable to a reflected XSS attack through a deletion confirmation message. The attacker-supplied script is executed when the victim clicks the \"No\" button. This issue is fixed in versions 16.10.10 and 17.4.2 of both XWiki Platform Flamingo Skin Resources and XWiki Platform Web Templates.","exploit_maturity":"Working exploit published","published":"2025-12-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-66516","description":"Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. \n\nThis CVE covers the same vulnerability as in CVE-2025-54988. However, this CVE expands the scope of affected packages in two ways. \n\nFirst, while the entrypoint for the vulnerability was the tika-parser-pdf-module as reported in CVE-2025-54988, the vulnerability and its fix were in tika-core. Users who upgraded the tika-parser-pdf-module but did not upgrade tika-core to \u003e= 3.2.2 would still be vulnerable. \n\nSecond, the original report failed to mention that in the 1.x Tika releases, the PDFParser was in the \"org.apache.tika:tika-parsers\" module.","exploit_maturity":"Working exploit published","published":"2025-12-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-55749","description":"XWiki is an open-source wiki software platform. From 16.7.0 to 16.10.11, 17.4.4, or 17.7.0, in an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials. Fixed in 16.10.11, 17.4.4, and 17.7.0.","exploit_maturity":"Working exploit published","published":"2025-12-01","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2025-5605","description":"An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure.\n\nThe known exposure from this issue is limited to memory statistics. While the vulnerability does not allow full account compromise, it still enables unauthorized access to internal system details.","exploit_maturity":"Working exploit published","published":"2025-10-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-5350","description":"SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature accepted user-supplied URLs without proper validation, leading to server-side request forgery (SSRF). Additionally, the retrieved content was directly reflected in the HTTP response, enabling reflected cross-site scripting (XSS) in the admin user's browser context.\n\nBy tricking an administrator into accessing a crafted link, an attacker could force the server to fetch malicious content and reflect it into the admin’s browser, leading to arbitrary JavaScript execution for UI manipulation or data exfiltration. While session cookies are protected with the HttpOnly flag, the XSS still poses a significant security risk.\n\nFurthermore, SSRF can be used by a privileged user to query internal services, potentially aiding in internal network enumeration if the target endpoints are reachable from the affected product.","exploit_maturity":"Working exploit published","published":"2025-10-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-11580","description":"A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.","exploit_maturity":"Working exploit published","published":"2025-10-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-52472","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0, the REST search URL is vulnerable to HQL injection via the `orderField` parameter. The specified value is added twice in the query, though, once in the field list for the select and once in the order clause, so it's not that easy to exploit. The part of the query between the two fields can be enclosed in single quotes to effectively remove them, but the query still needs to remain valid with the query two times in it. This has been patched in versions 17.5.0, 17.4.2, and 16.10.9. No known workarounds are available.","exploit_maturity":"Working exploit published","published":"2025-10-06","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-59474","description":"Jenkins 2.527 and earlier, LTS 2.516.2 and earlier does not perform a permission check in the sidepanel of a page intentionally accessible to users lacking Overall/Read permission, allowing attackers without Overall/Read permission to list agent names through its sidepanel executors widget.","exploit_maturity":"Working exploit published","published":"2025-09-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-41243","description":"Spring Cloud Gateway Server Webflux may be vulnerable to Spring Environment property modification.\n\nAn application should be considered vulnerable when all the following are true:\n\n  *  The application is using Spring Cloud Gateway Server Webflux (Spring Cloud Gateway Server WebMVC is not vulnerable).\n  *  Spring Boot actuator is a dependency.\n  *  The Spring Cloud Gateway Server Webflux actuator web endpoint is enabled via management.endpoints.web.exposure.include=gateway.\n  *  The actuator endpoints are available to attackers.\n  *  The actuator endpoints are unsecured.","exploit_maturity":"Working exploit published","published":"2025-09-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2025-55748","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-2 through 16.10.6, configuration files are accessible through jsx and sx endpoints. It's possible to access and read configuration files by using URLs such as `http://localhost:8080/bin/ssx/Main/WebHome?resource=../../WEB-INF/xwiki.cfg\u0026minify=false`. This is fixed in version 16.10.7.","exploit_maturity":"Working exploit published","published":"2025-09-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-55747","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions  6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. This is fixed in version 16.10.7.","exploit_maturity":"Working exploit published","published":"2025-09-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-54988","description":"Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. An attacker may be able to read sensitive data or trigger malicious requests to internal resources or third-party servers. Note that the tika-parser-pdf-module is used as a dependency in several Tika packages including at least: tika-parsers-standard-modules, tika-parsers-standard-package, tika-app, tika-grpc and tika-server-standard.\n\nUsers are recommended to upgrade to version 3.2.2, which fixes this issue.","exploit_maturity":"Working exploit published","published":"2025-08-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-41242","description":"Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container.\n\nAn application can be vulnerable when all the following are true:\n\n  *  the application is deployed as a WAR or with an embedded Servlet container\n  *  the Servlet container  does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization \n  *  the application  serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling\n\n\nWe have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.","exploit_maturity":"Working exploit published","published":"2025-08-18","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2025-4576","description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/blogs/blogs-web/src/main/resources/META-INF/resources/blogs/entry_cover_image_caption.jsp","exploit_maturity":"Working exploit published","published":"2025-08-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-54125","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki Platform Legacy Old Core and XWiki Platform Old Core versions 1.1 through 16.4.6, 16.5.0-rc-1 through 16.10.4 and 17.0.0-rc-1 through 17.1.0, the XML export of a page in XWiki that can be triggered by any user with view rights on a page by appending ?xpage=xml to the URL includes password and email properties stored on a document that aren't named password or email. This is fixed in versions 16.4.7, 16.10.5 and 17.2.0-rc-1. To work around this issue, the file templates/xml.vm in the deployed WAR can be deleted if the XML isn't needed. There isn't any feature in XWiki itself that depends on the XML export.","exploit_maturity":"Working exploit published","published":"2025-08-06","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2025-32430","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, two templates contain reflected XSS vulnerabilities, allowing an attacker to execute malicious JavaScript code in the context of the victim's session by getting the victim to visit an attacker-controlled URL. This permits the attacker to perform arbitrary actions using the permissions of the victim. This issue is fixed in versions 16.4.8, 16.10.6 and 17.3.0-rc-1. To workaround the issue, manually patch the WAR with the same changes as the original patch.","exploit_maturity":"Working exploit published","published":"2025-08-06","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-32429","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an ORDER BY value. This is fixed in versions 16.10.6 and 17.3.0-rc-1.","exploit_maturity":"Working exploit published","published":"2025-07-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-30220","description":"GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.","exploit_maturity":"Working exploit published","published":"2025-06-10","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-27817","description":"A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including \"sasl.oauthbearer.token.endpoint.url\" and \"sasl.oauthbearer.jwks.endpoint.url\". Apache Kafka allows clients to read an arbitrary file and return the content in the error log, or sending requests to an unintended location. In applications where Apache Kafka Clients configurations can be specified by an untrusted party, attackers may use the \"sasl.oauthbearer.token.endpoint.url\" and \"sasl.oauthbearer.jwks.endpoint.url\" configuratin to read arbitrary contents of the disk and environment variables or make requests to an unintended location. In particular, this flaw may be used in Apache Kafka Connect to escalate from REST API access to filesystem/environment/URL access, which may be undesirable in certain environments, including SaaS products. \n\nSince Apache Kafka 3.9.1/4.0.0, we have added a system property (\"-Dorg.apache.kafka.sasl.oauthbearer.allowed.urls\") to set the allowed urls in SASL JAAS configuration. In 3.9.1, it accepts all urls by default for backward compatibility. However in 4.0.0 and newer, the default value is empty list and users have to set the allowed urls explicitly.","exploit_maturity":"Working exploit published","published":"2025-06-10","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2025-27505","description":"GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the index page. The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html). The REST API index can disclose whether certain extensions are installed. This vulnerability is fixed in 2.26.3 and 2.25.6. As a workaround, in ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer.","exploit_maturity":"Working exploit published","published":"2025-06-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2024-29198","description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.","exploit_maturity":"Working exploit published","published":"2025-06-10","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2025-27533","description":"Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ.\n\nDuring unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of service (DoS) by depleting process memory, thereby affecting applications and services that rely on the availability of the ActiveMQ broker when not using mutual TLS connections.\nThis issue affects Apache ActiveMQ: from 6.0.0 before 6.1.6, from 5.18.0 before 5.18.7, from 5.17.0 before 5.17.7, before 5.16.8. ActiveMQ 5.19.0 is not affected.\n\nUsers are recommended to upgrade to version 6.1.6+, 5.19.0+,  5.18.7+, 5.17.7, or 5.16.8 or which fixes the issue.\n\nExisting users may implement mutual TLS to mitigate the risk on affected brokers.","exploit_maturity":"Working exploit published","published":"2025-05-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-4388","description":"A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app-manager-web.","exploit_maturity":"Working exploit published","published":"2025-05-06","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-46554","description":"XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. There is no filtering for the results depending on current user rights, meaning an unauthenticated user could exploit this even in a private wiki. This issue has been patched in versions 14.10.22, 15.10.12, 16.4.3, and 16.7.0.","exploit_maturity":"Working exploit published","published":"2025-04-30","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-32970","description":"XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0.","exploit_maturity":"Working exploit published","published":"2025-04-30","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-31650","description":"Improper Input Validation vulnerability in Apache Tomcat. Incorrect error handling for some invalid HTTP priority headers resulted in incomplete clean-up of the failed request which created a memory leak. A large number of such requests could trigger an OutOfMemoryException resulting in a denial of service.\n\nThis issue affects Apache Tomcat: from 9.0.76 through 9.0.102, from 10.1.10 through 10.1.39, from 11.0.0-M2 through 11.0.5.\nThe following versions were EOL at the time the CVE was created but are \nknown to be affected: 8.5.90 though 8.5.100.\n\n\nUsers are recommended to upgrade to version 9.0.104, 10.1.40 or 11.0.6 which fix the issue.","exploit_maturity":"Working exploit published","published":"2025-04-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2025-32969","description":"XWiki is a generic wiki platform. In versions starting from 1.8 and prior to 15.10.16, 16.4.6, and 16.10.1, it is possible for a remote unauthenticated user to escape from the HQL execution context and perform a blind SQL injection to execute arbitrary SQL statements on the database backend, including when \"Prevent unregistered users from viewing pages, regardless of the page rights\" and \"Prevent unregistered users from editing pages, regardless of the page rights\" options are enabled. Depending on the used database backend, the attacker may be able to not only obtain confidential information such as password hashes from the database, but also execute UPDATE/INSERT/DELETE queries. This issue has been patched in versions 16.10.1, 16.4.6 and 15.10.16. There is no known workaround, other than upgrading XWiki.","exploit_maturity":"Working exploit published","published":"2025-04-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2025-29085","description":"SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component.","exploit_maturity":"Working exploit published","published":"2025-04-02","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-56325","description":"Authentication Bypass Issue\n\nIf the path does not contain / and contain., authentication is not required.\n\nExpected Normal Request and Response Example\n\ncurl -X POST -H \"Content-Type: application/json\" -d {\\\"username\\\":\\\"hack2\\\",\\\"password\\\":\\\"hack\\\",\\\"component\\\":\\\"CONTROLLER\\\",\\\"role\\\":\\\"ADMIN\\\",\\\"tables\\\":[],\\\"permissions\\\":[],\\\"usernameWithComponent\\\":\\\"hack_CONTROLLER\\\"}  http://{server_ip}:9000/users \n\n\nReturn: {\"code\":401,\"error\":\"HTTP 401 Unauthorized\"}\n\n\nMalicious Request and Response Example \n\ncurl -X POST -H \"Content-Type: application/json\" -d '{\\\"username\\\":\\\"hack\\\",\\\"password\\\":\\\"hack\\\",\\\"component\\\":\\\"CONTROLLER\\\",\\\"role\\\":\\\"ADMIN\\\",\\\"tables\\\":[],\\\"permissions\\\":[],\\\"usernameWithComponent\\\":\\\"hack_CONTROLLER\\\"}'  http://{serverip}:9000/users; http://{serverip}:9000/users; .\n\n\nReturn: {\"users\":{}}\n\n\n\n \n\nA new user gets added bypassing authentication, enabling the user to control Pinot.","exploit_maturity":"Working exploit published","published":"2025-04-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2025-27888","description":"Severity: medium (5.8) / important\n\nServer-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid.\n\nThis issue affects all previous Druid versions.\n\n\nWhen using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected.\n\n\nUsers are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2025-03-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2025-29925","description":"XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wikis/[wikiName]/pages even if the user doesn't have view rights on them. It's particularly true if the entire wiki is protected with \"Prevent unregistered user to view pages\": the endpoint would still list the pages of the wiki, though only for the main wiki. The problem has been patched in XWiki 15.10.14, 16.4.6, 16.10.0RC1. In those versions the endpoint can still be requested but the result is filtered out based on pages rights.","exploit_maturity":"Working exploit published","published":"2025-03-19","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2024-56512","description":"Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups.\n\nCreating a new Process Group can include binding to a Parameter Context, but in cases where the Process Group did not reference any Parameter values, the framework did not check user authorization for the bound Parameter Context. Missing authorization for a bound Parameter Context enabled clients to download non-sensitive Parameter values after creating the Process Group.\n\nCreating a new Process Group can also include referencing existing Controller Services or Parameter Providers. The framework did not check user authorization for referenced Controller Services or Parameter Providers, enabling clients to create Process Groups and use these components that were otherwise unauthorized.\n\nThis vulnerability is limited in scope to authenticated users authorized to create Process Groups. The scope is further limited to deployments with component-based authorization policies. Upgrading to Apache NiFi 2.1.0 is the recommended mitigation, which includes authorization checking for Parameter and Controller Service references on Process Group creation.","exploit_maturity":"Working exploit published","published":"2024-12-28","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2024-43441","description":"Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server.\n\nThis issue affects Apache HugeGraph-Server: from 1.0.0 before 1.5.0.\n\nUsers are recommended to upgrade to version 1.5.0, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2024-12-24","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2024-38819","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.","exploit_maturity":"Working exploit published","published":"2024-12-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-48307","description":"JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.","exploit_maturity":"Working exploit published","published":"2024-10-31","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-45216","description":"Improper Authentication vulnerability in Apache Solr.\n\nSolr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass.\nA fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path.\nThis fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing.\n\n\nThis issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0.\n\nUsers are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.","exploit_maturity":"Working exploit published","published":"2024-10-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2024-3656","description":"A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.","exploit_maturity":"Working exploit published","published":"2024-10-09","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2024-8883","description":"A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.","exploit_maturity":"Working exploit published","published":"2024-09-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2024-8698","description":"A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Reference element used to specify the signed element. This flaw allows attackers to create crafted responses that can bypass the validation, potentially leading to privilege escalation or impersonation attacks.","exploit_maturity":"Working exploit published","published":"2024-09-19","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2024-38816","description":"Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.\n\nSpecifically, an application is vulnerable when both of the following are true:\n\n  *  the web application uses RouterFunctions to serve static resources\n  *  resource handling is explicitly configured with a FileSystemResource location\n\n\nHowever, malicious requests are blocked and rejected when any of the following is true:\n\n  *  the  Spring Security HTTP Firewall https://docs.spring.io/spring-security/reference/servlet/exploits/firewall.html  is in use\n  *  the application runs on Tomcat or Jetty","exploit_maturity":"Working exploit published","published":"2024-09-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-45591","description":"XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the author of the modification (both username and displayed name) and the version comment. This information is exposed regardless of the rights setup, and even when the wiki is configured to be fully private. On a private wiki, this can be tested by accessing /xwiki/rest/wikis/xwiki/spaces/Main/pages/WebHome/history, if this shows the history of the main page then the installation is vulnerable. This has been patched in XWiki 15.10.9 and XWiki 16.3.0RC1.","exploit_maturity":"Working exploit published","published":"2024-09-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2024-30188","description":"File read and write vulnerability in Apache DolphinScheduler ,  authenticated users can illegally access additional resource files.\nThis issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2.\n\nUsers are recommended to upgrade to version 3.2.2, which fixes the issue.","exploit_maturity":"Working exploit published","published":"2024-08-12","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2024-41947","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. By creating a conflict when another user with more rights is currently editing a page, it is possible to execute JavaScript snippets on the side of the other user, which compromises the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.10.8 and 16.3.0RC1.","exploit_maturity":"Working exploit published","published":"2024-07-31","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2024-41667","description":"OpenAM is an open access management solution. In versions 15.0.3 and prior, the `getCustomLoginUrlTemplate` method in RealmOAuth2ProviderSettings.java is vulnerable to template injection due to its usage of user input. Although the developer intended to implement a custom URL for handling login to override the default OpenAM login, they did not restrict the `CustomLoginUrlTemplate`, allowing it to be set freely. Commit fcb8432aa77d5b2e147624fe954cb150c568e0b8 introduces `TemplateClassResolver.SAFER_RESOLVER` to disable the resolution of commonly exploited classes in FreeMarker template injection. As of time of publication, this fix is expected to be part of version 15.0.4.","exploit_maturity":"Working exploit published","published":"2024-07-24","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2024-21136","description":"Vulnerability in the Oracle Retail Xstore Office product of Oracle Retail Applications (component: Security).  Supported versions that are affected are 19.0.5, 20.0.3, 20.0.4, 22.0.0 and  23.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Retail Xstore Office.  While the vulnerability is in Oracle Retail Xstore Office, attacks may significantly impact additional products (scope change).  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Retail Xstore Office accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2024-07-16","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2024-36404","description":"GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.","exploit_maturity":"Working exploit published","published":"2024-07-02","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2024-5276","description":"A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL injection is not possible using this vulnerability. Successful unauthenticated exploitation requires a Workflow system with anonymous access enabled, otherwise an authenticated user is required. This issue affects all versions of FileCatalyst Workflow from 5.1.6 Build 135 and earlier.","exploit_maturity":"Working exploit published","published":"2024-06-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2024-29868","description":"Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) vulnerability in Apache StreamPipes user self-registration and password recovery mechanism.\nThis allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account.\nThis issue affects Apache StreamPipes: from 0.69.0 through 0.93.0.\n\nUsers are recommended to upgrade to version 0.95.0, which fixes the issue.\n\n","exploit_maturity":"Working exploit published","published":"2024-06-24","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2024-36117","description":"Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite v3.5.10 is affected by an Arbitrary File Read vulnerability via path traversal while serving expanded javadoc files. Reposilite has addressed this issue in version 3.5.12. There are no known workarounds for this vulnerability. This issue was discovered and reported by the GitHub Security lab and is also tracked as GHSL-2024-074.","exploit_maturity":"Working exploit published","published":"2024-06-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-35219","description":"OpenAPI Generator allows generation of API client libraries (SDK generation), server stubs, documentation and configuration automatically given an OpenAPI Spec. Prior to version 7.6.0, attackers can exploit a path traversal vulnerability to read and delete files and folders from an arbitrary, writable directory as anyone can set the output folder when submitting the request via the `outputFolder` option. The issue was fixed in version 7.6.0 by removing the usage of the `outputFolder` option. No known workarounds are available.","exploit_maturity":"Working exploit published","published":"2024-05-27","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2024-32114","description":"In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located).\nIt means that anyone can use these layers without any required authentication. Potentially, anyone can interact with the broker (using Jolokia JMX REST API) and/or produce/consume messages or purge/delete destinations (using the Message REST API).\n\nTo mitigate, users can update the default conf/jetty.xml configuration file to add authentication requirement:\n\u003cbean id=\"securityConstraintMapping\" class=\"org.eclipse.jetty.security.ConstraintMapping\"\u003e\n  \u003cproperty name=\"constraint\" ref=\"securityConstraint\" /\u003e\n  \u003cproperty name=\"pathSpec\" value=\"/\" /\u003e\n\u003c/bean\u003e\n\nOr we encourage users to upgrade to Apache ActiveMQ 6.1.2 where the default configuration has been updated with authentication by default.\n","exploit_maturity":"Working exploit published","published":"2024-05-02","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2024-31982","description":"XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a closed wiki as the database search is by default accessible for all users. This impacts the confidentiality, integrity and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 14.10.20, 15.5.4 and 15.10RC1. As a workaround, one may manually apply the patch to the page `Main.DatabaseSearch`. Alternatively, unless database search is explicitly used by users, this page can be deleted as this is not the default search interface of XWiki.","exploit_maturity":"Working exploit published","published":"2024-04-10","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2024-28253","description":"OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.","exploit_maturity":"Working exploit published","published":"2024-03-15","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2024-25608","description":"HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.","exploit_maturity":"Working exploit published","published":"2024-02-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2024-24565","description":"CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage. This vulnerability is patched in 5.3.9, 5.4.8, 5.5.4, and 5.6.1.","exploit_maturity":"Working exploit published","published":"2024-01-30","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2023-50290","description":"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr.\nThe Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designed to work for known secret Java system properties. Environment variables cannot be strictly defined in Solr, like Java system properties can be, and may be set for the entire host, unlike Java system properties which are set per-Java-proccess.\n\nThe Solr Metrics API is protected by the \"metrics-read\" permission.\nTherefore, Solr Clouds with Authorization setup will only be vulnerable via users with the \"metrics-read\" permission.\nThis issue affects Apache Solr: from 9.0.0 before 9.3.0.\n\nUsers are recommended to upgrade to version 9.3.0 or later, in which environment variables are not published via the Metrics API.\n\n","exploit_maturity":"Working exploit published","published":"2024-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2024-21650","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. This issue allows an attacker to execute arbitrary code by crafting malicious payloads in the \"first name\" or \"last name\" fields during user registration. This impacts all installations that have user registration enabled for guests. This vulnerability has been patched in XWiki 14.10.17, 15.5.3 and 15.8 RC1.","exploit_maturity":"Working exploit published","published":"2024-01-08","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-50578","description":"Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.","exploit_maturity":"Working exploit published","published":"2023-12-30","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-50720","description":"XWiki Platform is a generic wiki platform. Prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the email addresses of users even when obfuscation of email addresses is enabled. To demonstrate the vulnerability, search for `objcontent:email*` using XWiki's regular search interface. This has been fixed in XWiki 14.10.15, 15.5.2 and 15.7RC1 by not indexing email address properties when obfuscation is enabled. There are no known workarounds for this vulnerability.\n","exploit_maturity":"Working exploit published","published":"2023-12-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2023-50719","description":"XWiki Platform is a generic wiki platform. Starting in 7.2-milestone-2 and prior to versions 14.10.15, 15.5.2, and 15.7-rc-1, the Solr-based search in XWiki discloses the password hashes of all users to anyone with view right on the respective user profiles. By default, all user profiles are public. This vulnerability also affects any configurations used by extensions that contain passwords like API keys that are viewable for the attacker. Normally, such passwords aren't accessible but this vulnerability would disclose them as plain text.  This has been patched in XWiki 14.10.15, 15.5.2 and 15.7RC1. There are no known workarounds for this vulnerability.\n","exploit_maturity":"Working exploit published","published":"2023-12-15","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2023-6379","description":"Cross-site scripting (XSS) vulnerability in Alkacon Software Open CMS, affecting versions 14 and 15 of the 'Mercury' template. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload to a victim and partially take control of their browsing session.","exploit_maturity":"Working exploit published","published":"2023-12-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2022-41678","description":"Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. \n\nIn details, in ActiveMQ configurations, jetty allows\norg.jolokia.http.AgentServlet to handler request to /api/jolokia\n\norg.jolokia.http.HttpRequestHandler#handlePostRequest is able to\ncreate JmxRequest through JSONObject. And calls to\norg.jolokia.http.HttpRequestHandler#executeRequest.\n\nInto deeper calling stacks,\norg.jolokia.handler.ExecHandler#doHandleRequest can be invoked\nthrough refection. This could lead to RCE through via\nvarious mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11.\n\n1 Call newRecording.\n\n2 Call setConfiguration. And a webshell data hides in it.\n\n3 Call startRecording.\n\n4 Call copyTo method. The webshell will be written to a .jsp file.\n\nThe mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia.\nA more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.\n","exploit_maturity":"Working exploit published","published":"2023-11-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2023-48292","description":"The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacker to execute arbitrary shell commands by tricking an admin into loading the URL with the shell command. A very simple possibility for an attack are comments. When the attacker can leave a comment on any page in the wiki it is sufficient to include an image with an URL like  `/xwiki/bin/view/Admin/RunShellCommand?command=touch%20/tmp/attacked` in the comment. When an admin views the comment, the file `/tmp/attacked` will be created on the server. The output of the command is also vulnerable to XWiki syntax injection which offers a simple way to execute Groovy in the context of the XWiki installation and thus an even easier way to compromise the integrity and confidentiality of the whole XWiki installation. This has been patched by adding a form token check in version 4.5.1 of the admin tools. Some workarounds are available. The patch can be applied manually to the affected wiki pages. Alternatively, the document `Admin.RunShellCommand` can also be deleted if the possibility to run shell commands isn't needed.","exploit_maturity":"Working exploit published","published":"2023-11-20","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-48241","description":"XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wikis to anybody who has access to it, by default it is public. This exposes all information stored in the wiki (but not some protected information like password hashes). While there is a right check normally, the right check can be circumvented by explicitly requesting fields from Solr that don't include the data for the right check. This has been fixed in XWiki 15.6RC1, 15.5.1 and 14.10.15 by not listing documents whose rights cannot be checked. No known workarounds are available.","exploit_maturity":"Working exploit published","published":"2023-11-20","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2023-6038","description":"A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3.","exploit_maturity":"Working exploit published","published":"2023-11-16","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2023-46732","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting (RXSS) via the `rev` parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the user, including remote code (Groovy) execution in the case of a user with programming right, compromising the confidentiality, integrity and availability of the whole XWiki installation. This has been patched in XWiki 15.6 RC1, 15.5.1 and 14.10.14. The patch in commit `04e325d57` can be manually applied without upgrading (or restarting) the instance. Users are advised to upgrade or to manually apply the patch. There are no known workarounds for this vulnerability.","exploit_maturity":"Working exploit published","published":"2023-11-06","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-45136","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy (disabled by default), XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflected cross-site scripting attack in the page creation form. This allows an attacker to execute arbitrary actions with the rights of the user opening the malicious link. Depending on the rights of the user, this may allow remote code execution and full read and write access to the whole XWiki installation. This has been patched in XWiki 14.10.12 and 15.5-rc-1 by adding appropriate escaping. The vulnerable template file `createinline.vm` is part of XWiki's WAR and can be patched by manually applying the changes from the fix.","exploit_maturity":"Working exploit published","published":"2023-10-25","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-43795","description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service (WPS) specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request Forgery. This vulnerability has been patched in version 2.22.5 and 2.23.2.","exploit_maturity":"Working exploit published","published":"2023-10-25","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-45648","description":"Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially \ncrafted, invalid trailer header could cause Tomcat to treat a single \nrequest as multiple requests leading to the possibility of request \nsmuggling when behind a reverse proxy.\n\nOlder, EOL versions may also be affected.\n\n\nUsers are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.","exploit_maturity":"Working exploit published","published":"2023-10-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2023-4136","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CrafterCMS Engine on Windows, MacOS, Linux, x86, ARM, 64 bit allows Reflected XSS.This issue affects CrafterCMS: from 4.0.0 through 4.0.2, from 3.1.0 through 3.1.27.","exploit_maturity":"Working exploit published","published":"2023-08-03","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2023-3990","description":"A vulnerability classified as problematic has been found in Mingsoft MCMS up to 5.3.1. This affects an unknown part of the file search.do of the component HTTP POST Request Handler. The manipulation of the argument style leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-235611.","exploit_maturity":"Working exploit published","published":"2023-07-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2023-38992","description":"jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.","exploit_maturity":"Working exploit published","published":"2023-07-28","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-22047","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).  Supported versions that are affected are 8.59 and  8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2023-07-18","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2023-37462","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Improper escaping in the document `SkinsCode.XWikiSkinsSheet` leads to an injection vector from view right on that document to programming rights, or in other words, it is possible to execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. The attack works by opening a non-existing page with a name crafted to contain a dangerous payload. It is possible to check if an existing installation is vulnerable. See the linked GHSA for instructions on testing an installation. This issue has been patched in XWiki 14.4.8, 14.10.4 and 15.0-rc-1. Users are advised to upgrade. The fix commit `d9c88ddc` can also be applied manually to the impacted document `SkinsCode.XWikiSkinsSheet` and users unable to upgrade are advised to manually patch their installations.","exploit_maturity":"Working exploit published","published":"2023-07-14","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-37582","description":"The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. \n\nWhen NameServer address are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by using the update configuration function on the NameServer component to execute commands as the system users that RocketMQ is running as. \n\nIt is recommended for users to upgrade their NameServer version to 5.1.2 or above for RocketMQ 5.x or 4.9.7 or above for RocketMQ 4.x to prevent these attacks.","exploit_maturity":"Working exploit published","published":"2023-07-12","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-35162","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the previewactions template to perform a XSS, e.g. by using URL such as: \u003e \u003chostname\u003e/xwiki/bin/get/FlamingoThemes/Cerulean xpage=xpart\u0026vm=previewactions.vm\u0026xcontinue=javascript:alert(document.domain). This vulnerability exists since XWiki 6.1-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-35161","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/view/AppWithinMinutes/DeleteApplication?appName=Menu\u0026resolve=true\u0026xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.2-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.\n","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-35160","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/view/XWiki/Main xpage=resubmit\u0026resubmit=javascript:alert(document.domain)\u0026xback=javascript:alert(document.domain). This vulnerability exists since XWiki 2.5-milestone-2. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-35159","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the deletespace template to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 3.4-milestone-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1.","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-35158","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as: \u003e /xwiki/bin/view/XWiki/Main?xpage=restore\u0026showBatch=true\u0026xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 9.4-rc-1. The vulnerability has been patched in XWiki 14.10.5 and 15.1-rc-1. ","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-35156","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as: \u003e xwiki/bin/get/FlamingoThemes/Cerulean?xpage=xpart\u0026vm=delete.vm\u0026xredirect=javascript:alert(document.domain). This vulnerability exists since XWiki 6.0-rc-1. The vulnerability has been patched in XWiki 14.10.6 and 15.1. Note that a partial patch has been provided in 14.10.5 but wasn't enough to entirely fix the vulnerability. \n","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2023-35155","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page (XSS). For instance, the following URL execute an `alter` on the browser: `\u003cxwiki-host\u003e/xwiki/bin/view/Main/?viewer=share\u0026send=1\u0026target=\u0026target=%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Cimg+src+onerror%3Dalert%28document.domain%29%3E+%3Crenniepak%40intigriti.me%3E\u0026includeDocument=inline\u0026message=I+wanted+to+share+this+page+with+you.`, where `\u003cxwiki-host\u003e` is the URL of your XWiki installation. The vulnerability has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8.\n","exploit_maturity":"Working exploit published","published":"2023-06-23","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2023-34659","description":"jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface.","exploit_maturity":"Working exploit published","published":"2023-06-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-33510","description":"Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.","exploit_maturity":"Working exploit published","published":"2023-06-07","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2023-32068","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect.  The issue has now been patched against all patterns that are known for performing redirects. This issue has been patched in XWiki 14.10.4 and 15.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.","exploit_maturity":"Working exploit published","published":"2023-05-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2023-25826","description":"Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was previously disclosed as CVE-2020-35476. Regex validation that was implemented to restrict allowed input to the query API does not work as intended, allowing crafted commands to bypass validation.","exploit_maturity":"Working exploit published","published":"2023-05-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-29923","description":"PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface.","exploit_maturity":"Working exploit published","published":"2023-04-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2023-29922","description":"PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.","exploit_maturity":"Working exploit published","published":"2023-04-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2023-29506","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.","exploit_maturity":"Working exploit published","published":"2023-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2023-29204","description":"XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1.\n","exploit_maturity":"Working exploit published","published":"2023-04-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2023-1454","description":"A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223299.","exploit_maturity":"Working exploit published","published":"2023-03-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-25157","description":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols.  CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.","exploit_maturity":"Working exploit published","published":"2023-02-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2023-25194","description":"A possible security vulnerability has been identified in Apache Kafka Connect API.\nThis requires access to a Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config\nand a SASL-based security protocol, which has been possible on Kafka Connect clusters since Apache Kafka Connect 2.3.0.\nWhen configuring the connector via the Kafka Connect REST API, an authenticated operator can set the `sasl.jaas.config`\nproperty for any of the connector's Kafka clients to \"com.sun.security.auth.module.JndiLoginModule\", which can be done via the\n`producer.override.sasl.jaas.config`, `consumer.override.sasl.jaas.config`, or `admin.override.sasl.jaas.config` properties.\nThis will allow the server to connect to the attacker's LDAP server\nand deserialize the LDAP response, which the attacker can use to execute java deserialization gadget chains on the Kafka connect server.\nAttacker can cause unrestricted deserialization of untrusted data (or) RCE vulnerability when there are gadgets in the classpath.\n\nSince Apache Kafka 3.0.0, users are allowed to specify these properties in connector configurations for Kafka Connect clusters running with out-of-the-box\nconfigurations. Before Apache Kafka 3.0.0, users may not specify these properties unless the Kafka Connect cluster has been reconfigured with a connector\nclient override policy that permits them.\n\nSince Apache Kafka 3.4.0, we have added a system property (\"-Dorg.apache.kafka.disallowed.login.modules\") to disable the problematic login modules usage\nin SASL JAAS configuration. Also by default \"com.sun.security.auth.module.JndiLoginModule\" is disabled in Apache Kafka Connect 3.4.0. \n\nWe advise the Kafka Connect users to validate connector configurations and only allow trusted JNDI configurations. Also examine connector dependencies for \nvulnerable versions and either upgrade their connectors, upgrading that specific dependency, or removing the connectors as options for remediation. Finally,\nin addition to leveraging the \"org.apache.kafka.disallowed.login.modules\" system property, Kafka Connect users can also implement their own connector\nclient config override policy, which can be used to control which Kafka client properties can be overridden directly in a connector config and which cannot.\n","exploit_maturity":"Working exploit published","published":"2023-02-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-37305","description":"An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive information via api uri: /sys/user/querySysUser?username=admin.","exploit_maturity":"Working exploit published","published":"2023-02-03","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2021-37304","description":"An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive information via the httptrace interface.","exploit_maturity":"Working exploit published","published":"2023-02-03","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2022-4375","description":"A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196.","exploit_maturity":"Working exploit published","published":"2022-12-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-42118","description":"A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the `tag` parameter.","exploit_maturity":"Working exploit published","published":"2022-11-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2022-42889","description":"Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is \"${prefix:name}\", where \"prefix\" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - \"script\" - execute expressions using the JVM script execution engine (javax.script) - \"dns\" - resolve dns records - \"url\" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.","exploit_maturity":"Working exploit published","published":"2022-10-13","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-36883","description":"A missing permission check in Jenkins Git Plugin 4.11.3 and earlier allows unauthenticated attackers to trigger builds of jobs configured to use an attacker-specified Git repository and to cause them to check out an attacker-specified commit.","exploit_maturity":"Working exploit published","published":"2022-07-27","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2022-32430","description":"An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application.","exploit_maturity":"Working exploit published","published":"2022-07-21","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2021-43116","description":"An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter username and password, click on login to capture packets and then change the returned package, which lets a malicious user login.","exploit_maturity":"Working exploit published","published":"2022-07-05","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2022-34305","description":"In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.","exploit_maturity":"Working exploit published","published":"2022-06-23","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2022-31268","description":"A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).","exploit_maturity":"Working exploit published","published":"2022-05-21","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-21500","description":"Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle E-Business Suite accessible data. Note: Authentication is required for successful attack, however the user may be self-registered. \u003cbr\u003e \u003cbr\u003eOracle E-Business Suite 12.1 is not impacted by this vulnerability. Customers should refer to the Patch Availability Document for details. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2022-05-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2022-29885","description":"The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.","exploit_maturity":"Working exploit published","published":"2022-05-12","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2021-40822","description":"GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.","exploit_maturity":"Working exploit published","published":"2022-05-02","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2021-31805","description":"The fix issued for CVE-2020-17530 was incomplete. So from Apache Struts 2.0.0 to 2.5.29, still some of the tag’s attributes could perform a double evaluation if a developer applied forced OGNL evaluation by using the %{...} syntax. Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation.","exploit_maturity":"Working exploit published","published":"2022-04-12","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2022-24819","description":"XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki versions 12.10.11, 13.4.4, and 13.9-rc-1. There is no known workaround for this problem.","exploit_maturity":"Working exploit published","published":"2022-04-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2022-26585","description":"Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list.","exploit_maturity":"Working exploit published","published":"2022-04-05","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-44138","description":"There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.","exploit_maturity":"Working exploit published","published":"2022-04-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-20323","description":"A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.","exploit_maturity":"Working exploit published","published":"2022-03-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2022-23898","description":"MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.","exploit_maturity":"Working exploit published","published":"2022-03-03","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-44521","description":"When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.","exploit_maturity":"Working exploit published","published":"2022-02-11","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2022-23944","description":"User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.","exploit_maturity":"Working exploit published","published":"2022-01-25","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2022-21371","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2022-01-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-42567","description":"Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.","exploit_maturity":"Working exploit published","published":"2021-12-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2021-22053","description":"Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.","exploit_maturity":"Working exploit published","published":"2021-11-19","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2021-37580","description":"A flaw was found in Apache ShenYu Admin. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. This issue affected Apache ShenYu 2.3.0 and 2.4.0","exploit_maturity":"Working exploit published","published":"2021-11-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2021-42697","description":"Akka HTTP 10.1.x before 10.1.15 and 10.2.x before 10.2.7 can encounter stack exhaustion while parsing HTTP headers, which allows a remote attacker to conduct a Denial of Service attack by sending a User-Agent header with deeply nested comments.","exploit_maturity":"Working exploit published","published":"2021-11-02","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2021-36749","description":"In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.","exploit_maturity":"Working exploit published","published":"2021-09-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2021-39152","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.","exploit_maturity":"Working exploit published","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39146","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"Working exploit published","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-39141","description":"XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.","exploit_maturity":"Working exploit published","published":"2021-08-23","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-22145","description":"A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details.","exploit_maturity":"Working exploit published","published":"2021-07-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2021-34429","description":"For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 \u0026 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.","exploit_maturity":"Working exploit published","published":"2021-07-15","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2021-28169","description":"For Eclipse Jetty versions \u003c= 9.4.40, \u003c= 10.0.2, \u003c= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.","exploit_maturity":"Working exploit published","published":"2021-06-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-6950","description":"Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.","exploit_maturity":"Working exploit published","published":"2021-06-02","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2021-23017","description":"A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.","exploit_maturity":"Working exploit published","published":"2021-06-01","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2021-29505","description":"XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.","exploit_maturity":"Working exploit published","published":"2021-05-28","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-33562","description":"A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.","exploit_maturity":"Working exploit published","published":"2021-05-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2021-33561","description":"A stored cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via customer_name in various forms of store administration. It is saved in the database. The code is executed for any user of store administration when information is fetched from the backend, e.g., in admin/customers/list.html.","exploit_maturity":"Working exploit published","published":"2021-05-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2021-29442","description":"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint is not protected and can be openly accessed by unauthenticated users. These endpoints are only valid when using embedded storage (derby DB) so this issue should not affect those installations using external storage (e.g. mysql)","exploit_maturity":"Working exploit published","published":"2021-04-27","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2021-29441","description":"Nacos is a platform designed for dynamic service discovery and configuration and service management. In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. This filter has a backdoor that enables Nacos servers to bypass this filter and therefore skip authentication checks. This mechanism relies on the user-agent HTTP header so it can be easily spoofed. This issue may allow any user to carry out any administrative tasks on the Nacos server.","exploit_maturity":"Working exploit published","published":"2021-04-27","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2021-2135","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Coherence Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2021-04-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-27850","description":"A critical unauthenticated remote code execution vulnerability was found all recent versions of Apache Tapestry. The affected versions include 5.4.5, 5.5.0, 5.6.2 and 5.7.0. The vulnerability I have found is a bypass of the fix for CVE-2019-0195. Recap: Before the fix of CVE-2019-0195 it was possible to download arbitrary class files from the classpath by providing a crafted asset file URL. An attacker was able to download the file `AppModule.class` by requesting the URL `http://localhost:8080/assets/something/services/AppModule.class` which contains a HMAC secret key. The fix for that bug was a blacklist filter that checks if the URL ends with `.class`, `.properties` or `.xml`. Bypass: Unfortunately, the blacklist solution can simply be bypassed by appending a `/` at the end of the URL: `http://localhost:8080/assets/something/services/AppModule.class/` The slash is stripped after the blacklist check and the file `AppModule.class` is loaded into the response. This class usually contains the HMAC secret key which is used to sign serialized Java objects. With the knowledge of that key an attacker can sign a Java gadget chain that leads to RCE (e.g. CommonsBeanUtils1 from ysoserial). Solution for this vulnerability: * For Apache Tapestry 5.4.0 to 5.6.1, upgrade to 5.6.2 or later. * For Apache Tapestry 5.7.0, upgrade to 5.7.1 or later.","exploit_maturity":"Working exploit published","published":"2021-04-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-27905","description":"The ReplicationHandler (normally registered at \"/replication\" under a Solr core) in Apache Solr has a \"masterUrl\" (also \"leaderUrl\" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. To prevent a SSRF vulnerability, Solr ought to check these parameters against a similar configuration it uses for the \"shards\" parameter. Prior to this bug getting fixed, it did not. This problem affects essentially all Solr versions prior to it getting fixed in 8.8.2.","exploit_maturity":"Working exploit published","published":"2021-04-13","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2021-28164","description":"In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.","exploit_maturity":"Working exploit published","published":"2021-04-01","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2021-21345","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.","exploit_maturity":"Working exploit published","published":"2021-03-23","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-27838","description":"A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality.","exploit_maturity":"Working exploit published","published":"2021-03-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2021-23337","description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","exploit_maturity":"Working exploit published","published":"2021-02-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21479","description":"In SCIMono before 0.0.19, it is possible for an attacker to inject and execute java expression compromising the availability and integrity of the system.","exploit_maturity":"Working exploit published","published":"2021-02-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2021-25646","description":"Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is intended for use in high-trust environments, and is disabled by default. However, in Druid 0.20.0 and earlier, it is possible for an authenticated user to send a specially-crafted request that forces Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid server process.","exploit_maturity":"Working exploit published","published":"2021-01-29","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2021-2109","description":"Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2021-01-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2021-21234","description":"spring-boot-actuator-logview in a library that adds a simple logfile viewer as spring boot actuator endpoint. It is maven package \"eu.hinsch:spring-boot-actuator-logview\". In spring-boot-actuator-logview before version 0.2.13 there is a directory traversal vulnerability. The nature of this library is to expose a log file directory via admin (spring boot actuator) HTTP endpoints. Both the filename to view and a base folder (relative to the logging folder root) can be specified via request parameters. While the filename parameter was checked to prevent directory traversal exploits (so that `filename=../somefile` would not work), the base folder parameter was not sufficiently checked, so that `filename=somefile\u0026base=../` could access a file outside the logging base directory). The vulnerability has been patched in release 0.2.13. Any users of 0.2.12 should be able to update without any issues as there are no other changes in that release. There is no workaround to fix the vulnerability other than updating or removing the dependency. However, removing read access of the user the application is run with to any directory not required for running the application can limit the impact. Additionally, access to the logview endpoint can be limited by deploying the application behind a reverse proxy.","exploit_maturity":"Working exploit published","published":"2021-01-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-17518","description":"Apache Flink 1.5.1 introduced a REST handler that allows you to write an uploaded file to an arbitrary location on the local file system, through a maliciously modified HTTP HEADER. The files can be written to any location accessible by Flink 1.5.1. All users should upgrade to Flink 1.11.3 or 1.12.0 if their Flink instance(s) are exposed. The issue was fixed in commit a5264a6f41524afe8ceadf1d8ddc8c80f323ebc4 from apache/flink:master.","exploit_maturity":"Working exploit published","published":"2021-01-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-35774","description":"server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.","exploit_maturity":"Working exploit published","published":"2020-12-29","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-35476","description":"A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)","exploit_maturity":"Working exploit published","published":"2020-12-16","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-26258","description":"XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.","exploit_maturity":"Working exploit published","published":"2020-12-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-10770","description":"A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.","exploit_maturity":"Working exploit published","published":"2020-12-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-13942","description":"It is possible to inject malicious OGNL or MVEL scripts into the /context.json public endpoint. This was partially fixed in 1.5.1 but a new attack vector was found. In Apache Unomi version 1.5.2 scripts are now completely filtered from the input. It is highly recommended to upgrade to the latest available version of the 1.5.x release to fix this problem.","exploit_maturity":"Working exploit published","published":"2020-11-24","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2020-26217","description":"XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.","exploit_maturity":"Working exploit published","published":"2020-11-16","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-13937","description":"Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha has one restful api which exposed Kylin's configuration information without any authentication, so it is dangerous because some confidential information entries will be disclosed to everyone.","exploit_maturity":"Working exploit published","published":"2020-10-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-7318","description":"Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10.9 Update 9 allows administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.","exploit_maturity":"Working exploit published","published":"2020-10-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-13951","description":"Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.","exploit_maturity":"Working exploit published","published":"2020-09-30","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2019-0230","description":"Apache Struts 2.0.0 to 2.5.20 forced double OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution.","exploit_maturity":"Working exploit published","published":"2020-09-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-23814","description":"Multiple cross-site scripting (XSS) vulnerabilities in xxl-job v2.2.0 allow remote attackers to inject arbitrary web script or HTML via (1) AppName and (2)AddressList parameter in JobGroupController.java file.","exploit_maturity":"Working exploit published","published":"2020-09-03","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-2231","description":"Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the remote address of the host starting a build via 'Trigger builds remotely', resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Job/Configure permission or knowledge of the Authentication Token.","exploit_maturity":"Working exploit published","published":"2020-08-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-2230","description":"Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by users with Overall/Manage permission.","exploit_maturity":"Working exploit published","published":"2020-08-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-2229","description":"Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the tooltip content of help icons, resulting in a stored cross-site scripting (XSS) vulnerability.","exploit_maturity":"Working exploit published","published":"2020-08-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-5412","description":"Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.","exploit_maturity":"Working exploit published","published":"2020-08-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-13935","description":"The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.","exploit_maturity":"Working exploit published","published":"2020-07-14","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2020-9480","description":"In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even without the shared key. This can be leveraged to execute shell commands on the host machine. This does not affect Spark clusters using other resource managers (YARN, Mesos, etc).","exploit_maturity":"Working exploit published","published":"2020-06-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2020-11975","description":"Apache Unomi allows conditions to use OGNL scripting which offers the possibility to call static Java classes from the JDK that could execute code with the permission level of the running Java process.","exploit_maturity":"Working exploit published","published":"2020-06-05","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2020-9484","description":"When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter=\"null\" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.","exploit_maturity":"Working exploit published","published":"2020-05-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2020-7656","description":"jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove \"\u003cscript\u003e\" HTML tags that contain a whitespace character, i.e: \"\u003c/script \u003e\", which results in the enclosed script logic to be executed.","exploit_maturity":"Working exploit published","published":"2020-05-19","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2020-2733","description":"Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2020-04-15","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2020-10204","description":"Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.","exploit_maturity":"Working exploit published","published":"2020-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2019-17564","description":"Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.","exploit_maturity":"Working exploit published","published":"2020-04-01","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2020-2140","description":"Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.","exploit_maturity":"Working exploit published","published":"2020-03-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-5405","description":"Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","exploit_maturity":"Working exploit published","published":"2020-03-05","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2020-9548","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).","exploit_maturity":"Working exploit published","published":"2020-03-02","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2020-9547","description":"FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).","exploit_maturity":"Working exploit published","published":"2020-03-02","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2020-2103","description":"Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.","exploit_maturity":"Working exploit published","published":"2020-01-29","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-7934","description":"In LifeRay Portal CE 7.1.0 through 7.2.1 GA2, the First Name, Middle Name, and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload, and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e., if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.","exploit_maturity":"Working exploit published","published":"2020-01-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2020-2096","description":"Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint, resulting in a reflected XSS vulnerability.","exploit_maturity":"Working exploit published","published":"2020-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-1592","description":"A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.","exploit_maturity":"Working exploit published","published":"2019-12-05","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2019-17554","description":"The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type \"application/xml\", which trigger the deserialization of entities, can be used to trigger XXE attacks.","exploit_maturity":"Working exploit published","published":"2019-12-04","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2013-5123","description":"The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.","exploit_maturity":"Working exploit published","published":"2019-11-05","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2011-3923","description":"Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.","exploit_maturity":"Working exploit published","published":"2019-11-01","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2019-18394","description":"A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.java in Ignite Realtime Openfire through 4.4.2 allows attackers to send arbitrary HTTP GET requests.","exploit_maturity":"Working exploit published","published":"2019-10-24","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2019-18393","description":"PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.","exploit_maturity":"Working exploit published","published":"2019-10-24","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2019-10475","description":"A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.","exploit_maturity":"Working exploit published","published":"2019-10-23","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-3025","description":"Vulnerability in the Oracle Hospitality RES 3700 component of Oracle Food and Beverage Applications. The supported version that is affected is 5.7. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality RES 3700. While the vulnerability is in Oracle Hospitality RES 3700, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality RES 3700. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2019-10-16","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2019-10405","description":"Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the \"Cookie\" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.","exploit_maturity":"Working exploit published","published":"2019-09-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-13237","description":"In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.","exploit_maturity":"Working exploit published","published":"2019-08-27","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2019-13236","description":"In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.","exploit_maturity":"Working exploit published","published":"2019-08-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-13235","description":"In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.","exploit_maturity":"Working exploit published","published":"2019-08-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-13234","description":"In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.","exploit_maturity":"Working exploit published","published":"2019-08-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-2861","description":"Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Planning accessible data. CVSS 3.0 Base Score 4.2 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N).","exploit_maturity":"Working exploit published","published":"2019-07-23","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2019-2767","description":"Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2019-07-23","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2019-2729","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2019-06-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-11269","description":"Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.","exploit_maturity":"Working exploit published","published":"2019-06-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-6588","description":"In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the \"url\" parameter of the JSP taglib call \u003cliferay-ui:captcha url=\"\u003c%= url %\u003e\" /\u003e or \u003cliferay-captcha:captcha url=\"\u003c%= url %\u003e\" /\u003e. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.","exploit_maturity":"Working exploit published","published":"2019-06-03","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-0221","description":"The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is, therefore, vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.","exploit_maturity":"Working exploit published","published":"2019-05-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-4279","description":"IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.","exploit_maturity":"Working exploit published","published":"2019-05-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2013-7285","description":"Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.","exploit_maturity":"Working exploit published","published":"2019-05-15","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-3799","description":"Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.","exploit_maturity":"Working exploit published","published":"2019-05-06","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2019-0186","description":"The input fields of the Apache Pluto \"Chat Room\" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file","exploit_maturity":"Working exploit published","published":"2019-04-26","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-2698","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2019-04-23","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2019-2697","description":"Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2019-04-23","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2019-2588","description":"Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). Supported versions that are affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 4.9 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2019-04-23","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-2579","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2019-04-23","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-2578","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2019-04-23","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2019-0232","description":"When running on Windows with enableCmdLineArguments enabled, the CGI Servlet in Apache Tomcat 9.0.0.M1 to 9.0.17, 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 is vulnerable to Remote Code Execution due to a bug in the way the JRE passes command line arguments to Windows. The CGI Servlet is disabled by default. The CGI option enableCmdLineArguments is disable by default in Tomcat 9.0.x (and will be disabled by default in all versions in response to this vulnerability). For a detailed explanation of the JRE behaviour, see Markus Wulftange's blog (https://codewhitesec.blogspot.com/2016/02/java-and-command-line-injections-in-windows.html) and this archived MSDN blog (https://web.archive.org/web/20161228144344/https://blogs.msdn.microsoft.com/twistylittlepassagesallalike/2011/04/23/everyone-quotes-command-line-arguments-the-wrong-way/).","exploit_maturity":"Working exploit published","published":"2019-04-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2019-3778","description":"Spring Security OAuth, versions 2.3 prior to 2.3.5, and 2.2 prior to 2.2.4, and 2.1 prior to 2.1.4, and 2.0 prior to 2.0.17, and older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the \"redirect_uri\" parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code. This vulnerability exposes applications that meet all of the following requirements: Act in the role of an Authorization Server (e.g. @EnableAuthorizationServer) and uses the DefaultRedirectResolver in the AuthorizationEndpoint. This vulnerability does not expose applications that: Act in the role of an Authorization Server and uses a different RedirectResolver implementation other than DefaultRedirectResolver, act in the role of a Resource Server only (e.g. @EnableResourceServer), act in the role of a Client only (e.g. @EnableOAuthClient).","exploit_maturity":"Working exploit published","published":"2019-03-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-0192","description":"In Apache Solr versions 5.0.0 to 5.5.5 and 6.0.0 to 6.6.5, the Config API allows to configure the JMX server via an HTTP POST request. By pointing it to a malicious RMI server, an attacker could take advantage of Solr's unsafe deserialization to trigger remote code execution on the Solr side.","exploit_maturity":"Working exploit published","published":"2019-03-07","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2019-6804","description":"An XSS issue was discovered on the Job Edit page in Rundeck Community Edition before 3.0.13, related to assets/javascripts/workflowStepEditorKO.js and views/execution/_wfitemEdit.gsp.","exploit_maturity":"Working exploit published","published":"2019-01-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2019-1003002","description":"A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","exploit_maturity":"Working exploit published","published":"2019-01-22","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2019-1003001","description":"A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.","exploit_maturity":"Working exploit published","published":"2019-01-22","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2019-1003000","description":"A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.","exploit_maturity":"Working exploit published","published":"2019-01-22","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2019-2413","description":"Vulnerability in the Oracle Reports Developer component of Oracle Fusion Middleware (subcomponent: Valid Session). The supported version that is affected is 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Reports Developer. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Reports Developer, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Reports Developer accessible data as well as unauthorized read access to a subset of Oracle Reports Developer accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2019-01-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2017-18349","description":"parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.","exploit_maturity":"Working exploit published","published":"2018-10-23","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2018-3245","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2018-10-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-3238","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). The supported version that is affected is 11.1.1.8.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 6.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2018-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2018-3167","description":"Vulnerability in the Application Management Pack for Oracle E-Business Suite component of Oracle E-Business Suite (subcomponent: User Monitoring). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Application Management Pack for Oracle E-Business Suite. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Application Management Pack for Oracle E-Business Suite accessible data. CVSS 3.0 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).","exploit_maturity":"Working exploit published","published":"2018-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2018-8006","description":"An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.","exploit_maturity":"Working exploit published","published":"2018-10-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2018-14335","description":"An issue was discovered in H2 1.4.197. Insecure handling of permissions in the backup function allows attackers to read sensitive files (outside of their permissions) via a symlink to a fake database file.","exploit_maturity":"Working exploit published","published":"2018-07-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2018-1999002","description":"A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.","exploit_maturity":"Working exploit published","published":"2018-07-23","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2018-2894","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS - Web Services). Supported versions that are affected are 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2018-07-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-2893","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.2 and 12.2.1.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2018-07-18","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-1306","description":"The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information.","exploit_maturity":"Working exploit published","published":"2018-06-27","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2018-1000600","description":"A exposure of sensitive information vulnerability exists in Jenkins GitHub Plugin 1.29.1 and earlier in GitHubTokenCredentialsCreator.java that allows attackers to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.","exploit_maturity":"Working exploit published","published":"2018-06-26","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2018-6671","description":"Application Protection Bypass vulnerability in McAfee ePolicy Orchestrator (ePO) 5.3.0 through 5.3.3 and 5.9.0 through 5.9.1 allows remote authenticated users to bypass localhost only access security protection for some ePO features via a specially crafted HTTP request.","exploit_maturity":"Working exploit published","published":"2018-06-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2018-1335","description":"From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.","exploit_maturity":"Working exploit published","published":"2018-04-25","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2018-2791","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Advanced UI). Supported versions that are affected are 11.1.1.8.0, 12.2.1.2.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Sites accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2018-04-19","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2018-1271","description":"Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.","exploit_maturity":"Working exploit published","published":"2018-04-06","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2018-8718","description":"Cross-site request forgery (CSRF) vulnerability in the Mailer Plugin 1.20 for Jenkins 2.111 allows remote authenticated users to send unauthorized mail as an arbitrary user via a /descriptorByName/hudson.tasks.Mailer/sendTestMail request.","exploit_maturity":"Working exploit published","published":"2018-03-27","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2018-1322","description":"An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters.","exploit_maturity":"Working exploit published","published":"2018-03-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2018-1321","description":"An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.","exploit_maturity":"Working exploit published","published":"2018-03-20","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2018-1000130","description":"A JNDI Injection vulnerability exists in Jolokia agent version 1.3.7 in the proxy mode that allows a remote attacker to run arbitrary Java code on the server.","exploit_maturity":"Working exploit published","published":"2018-03-14","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2018-1000129","description":"An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.","exploit_maturity":"Working exploit published","published":"2018-03-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2018-7318","description":"SQL Injection exists in the CheckList 1.1.1 component for Joomla! via the title_search, tag_search, name_search, description_search, or filter_order parameter.","exploit_maturity":"Working exploit published","published":"2018-02-22","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2018-2636","description":"Vulnerability in the Oracle Hospitality Simphony component of Oracle Hospitality Applications (subcomponent: Security). Supported versions that are affected are 2.7, 2.8 and 2.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hospitality Simphony. Successful attacks of this vulnerability can result in takeover of Oracle Hospitality Simphony. CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2018-01-18","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2017-10273","description":"Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment). Supported versions that are affected are 11.1.1.7.0, 11.1.1.7.1, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle JDeveloper, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data as well as unauthorized read access to a subset of Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.0 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L).","exploit_maturity":"Working exploit published","published":"2018-01-18","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2017-8046","description":"Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.","exploit_maturity":"Working exploit published","published":"2018-01-04","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2015-7501","description":"Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.","exploit_maturity":"Working exploit published","published":"2017-11-09","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-10366","description":"Vulnerability in the PeopleSoft Enterprise PT PeopleTools component of Oracle PeopleSoft Products (subcomponent: Performance Monitor). Supported versions that are affected are 8.54, 8.55 and 8.56. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","exploit_maturity":"Working exploit published","published":"2017-10-19","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2017-10355","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).","exploit_maturity":"Working exploit published","published":"2017-10-19","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2017-10033","description":"Vulnerability in the Oracle WebCenter Sites component of Oracle Fusion Middleware (subcomponent: Support Tools). Supported versions that are affected are 11.1.1.8.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter Sites executes to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle WebCenter Sites accessible data as well as unauthorized read access to a subset of Oracle WebCenter Sites accessible data. Note: Please refer to Doc ID \u003ca href=\"http://support.oracle.com/CSP/main/article?cmd=show\u0026type=NOT\u0026id=2318213.1\"\u003eMy Oracle Support Note 2318213.1 for instructions on how to address this issue. CVSS 3.0 Base Score 4.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-10-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2017-12629","description":"Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.","exploit_maturity":"Working exploit published","published":"2017-10-14","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-12611","description":"In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a RCE attack.","exploit_maturity":"Working exploit published","published":"2017-09-20","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-10246","description":"Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data as well as unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-08-08","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2017-10075","description":"Vulnerability in the Oracle WebCenter Content component of Oracle Fusion Middleware (subcomponent: Content Server). Supported versions that are affected are 11.1.1.9.0, 12.2.1.1.0 and 12.2.1.2.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-08-08","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2017-10046","description":"Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite (subcomponent: Web Access). Supported versions that are affected are 8.3, 8.4, 15.1, 15.2 and 16.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Primavera P6 Enterprise Project Portfolio Management. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Primavera P6 Enterprise Project Portfolio Management, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Primavera P6 Enterprise Project Portfolio Management accessible data as well as unauthorized read access to a subset of Primavera P6 Enterprise Project Portfolio Management accessible data. CVSS 3.0 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-08-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2017-11467","description":"OrientDB through 2.2.22 does not enforce privilege requirements during \"where\" or \"fetchplan\" or \"order by\" use, which allows remote attackers to execute arbitrary OS commands via a crafted request.","exploit_maturity":"Working exploit published","published":"2017-07-20","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2016-4977","description":"When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5, the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.","exploit_maturity":"Working exploit published","published":"2017-05-25","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2017-7504","description":"HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server \u003c= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data.","exploit_maturity":"Working exploit published","published":"2017-05-19","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-3549","description":"Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).","exploit_maturity":"Working exploit published","published":"2017-04-24","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-3548","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).","exploit_maturity":"Working exploit published","published":"2017-04-24","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2017-3546","description":"Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: MultiChannel Framework). Supported versions that are affected are 8.54 and 8.55. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.0 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-04-24","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2017-3528","description":"Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (lists of values, datepicker, etc.)). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily \"exploitable\" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Applications Framework, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.0 Base Score 4.7 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N).","exploit_maturity":"Working exploit published","published":"2017-04-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2017-5645","description":"In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.","exploit_maturity":"Working exploit published","published":"2017-04-17","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-6816","description":"The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1 to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack and/or obtain sensitive information from requests other then their own.","exploit_maturity":"Working exploit published","published":"2017-03-20","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-4316","description":"Multiple cross-site scripting (XSS) vulnerabilities in WSO2 Carbon 4.4.5 allow remote attackers to inject arbitrary web script or HTML via the (1) setName parameter to identity-mgt/challenges-mgt.jsp; the (2) webappType or (3) httpPort parameter to webapp-list/webapp_info.jsp; the (4) dsName or (5) description parameter to ndatasource/newdatasource.jsp; the (6) phase parameter to viewflows/handlers.jsp; or the (7) url parameter to ndatasource/validateconnection-ajaxprocessor.jsp.","exploit_maturity":"Working exploit published","published":"2017-02-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2016-4314","description":"Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.","exploit_maturity":"Working exploit published","published":"2017-02-17","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2017-3248","description":"Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Core Components). Supported versions that are affected are 10.3.6.0, 12.1.3.0, 12.2.1.0 and 12.2.1.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS v3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).","exploit_maturity":"Working exploit published","published":"2017-01-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2017-3241","description":"Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 6u131, 7u121 and 8u112; Java SE Embedded: 8u111; JRockit: R28.3.12. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. While the vulnerability is in Java SE, Java SE Embedded, JRockit, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS v3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts).","exploit_maturity":"Working exploit published","published":"2017-01-27","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-5725","description":"Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\\ (dot dot backslash) in a response to a recursive GET command.","exploit_maturity":"Working exploit published","published":"2017-01-19","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2016-9299","description":"The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.","exploit_maturity":"Working exploit published","published":"2017-01-12","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2016-3473","description":"Unspecified vulnerability in the BI Publisher (formerly XML Publisher) component in Oracle Fusion Middleware 11.1.1.7.0, 11.1.1.9.0, and 12.2.1.0.0 allows remote authenticated users to affect confidentiality via unknown vectors.","exploit_maturity":"Working exploit published","published":"2016-10-25","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2016-7065","description":"The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object.","exploit_maturity":"Working exploit published","published":"2016-10-13","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-5425","description":"The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/lib/tmpfiles.d/tomcat.conf, which allows local users to gain root privileges by leveraging membership in the tomcat group.","exploit_maturity":"Working exploit published","published":"2016-10-13","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2015-2080","description":"The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.","exploit_maturity":"Working exploit published","published":"2016-10-07","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2016-1240","description":"The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.","exploit_maturity":"Working exploit published","published":"2016-10-03","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2016-3542","description":"Unspecified vulnerability in the Oracle Knowledge Management component in Oracle E-Business Suite 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, and 12.2.5 allows remote administrators to affect confidentiality and integrity via unknown vectors.","exploit_maturity":"Working exploit published","published":"2016-07-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2016-3510","description":"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.","exploit_maturity":"Working exploit published","published":"2016-07-21","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2016-3670","description":"Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.","exploit_maturity":"Working exploit published","published":"2016-06-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2016-3087","description":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.","exploit_maturity":"Working exploit published","published":"2016-06-07","resolved":"MITIGATION-CANDIDATE","severity":"Critical"},
  {"cve_id":"CVE-2015-7611","description":"Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.","exploit_maturity":"Working exploit published","published":"2016-06-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-3081","description":"Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.","exploit_maturity":"Working exploit published","published":"2016-04-26","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0784","description":"Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.","exploit_maturity":"Working exploit published","published":"2016-04-11","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2016-0710","description":"Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.","exploit_maturity":"Working exploit published","published":"2016-04-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0709","description":"Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by \"../../webapps/x.jsp.\"","exploit_maturity":"Working exploit published","published":"2016-04-11","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0792","description":"Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.","exploit_maturity":"Working exploit published","published":"2016-04-07","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2016-0793","description":"Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) \"meaningless\" characters.","exploit_maturity":"Working exploit published","published":"2016-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2016-0956","description":"The Servlets Post component 2.3.6 in Apache Sling, as used in Adobe Experience Manager 5.6.1, 6.0.0, and 6.1.0, allows remote attackers to obtain sensitive information via unspecified vectors.","exploit_maturity":"Working exploit published","published":"2016-02-10","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2016-0492","description":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0488.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function, which allows remote attackers to bypass authentication via directory traversal sequences following a URI entry that does not require authentication, as demonstrated by olt/Login.do/../../olt/UploadFileUpload.do.","exploit_maturity":"Working exploit published","published":"2016-01-21","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2016-0491","description":"Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.  NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.","exploit_maturity":"Working exploit published","published":"2016-01-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2015-8103","description":"The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the \"Groovy variant in 'ysoserial'\".","exploit_maturity":"Working exploit published","published":"2015-11-25","resolved":"MITIGATED-BY-RASP","severity":"Critical"},
  {"cve_id":"CVE-2015-4878","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4877.","exploit_maturity":"Working exploit published","published":"2015-10-21","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2015-4877","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.5.0, 8.5.1, and 8.5.2 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-4878.","exploit_maturity":"Working exploit published","published":"2015-10-21","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2015-1830","description":"Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.","exploit_maturity":"Working exploit published","published":"2015-08-19","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2015-5531","description":"Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.","exploit_maturity":"Working exploit published","published":"2015-08-17","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2015-1833","description":"XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.","exploit_maturity":"Working exploit published","published":"2015-05-29","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2015-3337","description":"Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.","exploit_maturity":"Working exploit published","published":"2015-05-01","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2015-2572","description":"Unspecified vulnerability in the Oracle Hyperion Smart View for Office component in Oracle Hyperion 11.1.2.5.216 and earlier, when running on Windows, allows local users to affect confidentiality, integrity, and availability via unknown vectors related to Core.","exploit_maturity":"Working exploit published","published":"2015-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2015-0493","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.1, 8.5.0, and 8.5.1 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-0474.","exploit_maturity":"Working exploit published","published":"2015-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2015-0474","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.1, 8.5.0, and 8.5.1 allows local users to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2015-0493.","exploit_maturity":"Working exploit published","published":"2015-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2014-4210","description":"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect confidentiality via vectors related to WLS - Web Services.","exploit_maturity":"Working exploit published","published":"2014-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2011-4367","description":"Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.","exploit_maturity":"Working exploit published","published":"2014-06-19","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2014-3004","description":"The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.","exploit_maturity":"Working exploit published","published":"2014-06-11","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2014-0114","description":"Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.","exploit_maturity":"Working exploit published","published":"2014-04-30","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-0113","description":"CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getClass method, which allows remote attackers to \"manipulate\" the ClassLoader and execute arbitrary code via a crafted request. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-0094.","exploit_maturity":"Working exploit published","published":"2014-04-29","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2014-1216","description":"FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.","exploit_maturity":"Working exploit published","published":"2014-04-22","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2014-2880","description":"Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the backUrl parameter in a changepwd action to identity/faces/firstlogin.","exploit_maturity":"Working exploit published","published":"2014-04-17","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2014-2424","description":"Unspecified vulnerability in the Oracle Event Processing component in Oracle Fusion Middleware 11.1.1.7.0 allows remote authenticated users to affect integrity via vectors related to CEP system.","exploit_maturity":"Working exploit published","published":"2014-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2014-2399","description":"Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 2.2.2 allows remote attackers to affect integrity via unknown vectors related to Oracle Endeca Information Discovery (Formerly Latitude), a different vulnerability than CVE-2014-2400.","exploit_maturity":"Working exploit published","published":"2014-04-16","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2014-0050","description":"MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.","exploit_maturity":"Working exploit published","published":"2014-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2014-0094","description":"The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to \"manipulate\" the ClassLoader via the class parameter, which is passed to the getClass method.","exploit_maturity":"Working exploit published","published":"2014-03-11","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2014-1202","description":"The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.","exploit_maturity":"Working exploit published","published":"2014-01-25","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2014-0379","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0.x, 7.3.1.x, 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect integrity via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2014-0372","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, and 12.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-5880","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 12.2.0, 12.2.1, and 12.2.2 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-5877","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.0, and 12.2.1 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-5795","description":"Unspecified vulnerability in the Oracle Demantra Demand Management component in Oracle Supply Chain Products Suite 7.2.0.3 SQL-Server, 7.3.0, 7.3.1, 12.2.1, 12.2.2, and 12.2.3 allows remote attackers to affect confidentiality via unknown vectors related to DM Others.","exploit_maturity":"Working exploit published","published":"2014-01-15","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-5573","description":"Cross-site scripting (XSS) vulnerability in the default markup formatter in Jenkins 1.523 allows remote attackers to inject arbitrary web script or HTML via the Description field in the user configuration.","exploit_maturity":"Working exploit published","published":"2013-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-5676","description":"The Jenkins Plugin for SonarQube 3.7 and earlier allows remote authenticated users to obtain sensitive information (cleartext passwords) by reading the value in the sonar.sonarPassword parameter from jenkins/configure.","exploit_maturity":"Working exploit published","published":"2013-12-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-6357","description":"Cross-site request forgery (CSRF) vulnerability in the Manager application in Apache Tomcat 5.5.25 and earlier allows remote attackers to hijack the authentication of administrators for requests that manipulate application deployment via the POST method, as demonstrated by a /manager/html/undeploy?path= URI.  NOTE: the vendor disputes the significance of this report, stating that \"the Apache Tomcat Security team has not accepted any reports of CSRF attacks against the Manager application ... as they require a reckless system administrator.","exploit_maturity":"Working exploit published","published":"2013-11-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-4295","description":"The gadget renderer in Apache Shindig 2.5.0 for PHP allows remote attackers to obtain sensitive information via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.","exploit_maturity":"Working exploit published","published":"2013-10-24","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2013-5791","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.4.0 and 8.4.1 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters.  NOTE: the previous information is from the October 2013 CPU. Oracle has not commented on claims from a third party that the issue is a stack-based buffer overflow in the Microsoft Access 1.x parser in vsacs.dll before 8.4.0.108 and before 8.4.1.52, which allows attackers to execute arbitrary code via a long field (aka column) name.","exploit_maturity":"Working exploit published","published":"2013-10-16","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2013-3827","description":"Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.","exploit_maturity":"Working exploit published","published":"2013-10-16","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2013-2160","description":"The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.","exploit_maturity":"Working exploit published","published":"2013-08-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-4883","description":"Multiple cross-site scripting (XSS) vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePO Extension for the McAfee Agent (MA) 4.5 through 4.6, allow remote attackers to inject arbitrary web script or HTML via the (1) instanceId parameter core/loadDisplayType.do; (2) instanceId or (3) monitorUrl parameter to console/createDashboardContainer.do; uid parameter to (4) ComputerMgmt/sysDetPanelBoolPie.do or (5) ComputerMgmt/sysDetPanelSummary.do; (6) uid, (7) orion.user.security.token, or (8) ajaxMode parameter to ComputerMgmt/sysDetPanelQry.do; or (9) uid, (10) orion.user.security.token, or (11) ajaxMode parameter to ComputerMgmt/sysDetPanelSummary.do.","exploit_maturity":"Working exploit published","published":"2013-07-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-4882","description":"Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5 and 4.6, allow remote authenticated users to execute arbitrary SQL commands via the uid parameter to (1) core/showRegisteredTypeDetails.do and (2) EPOAGENTMETA/DisplayMSAPropsDetail.do, a different vulnerability than CVE-2013-0140.","exploit_maturity":"Working exploit published","published":"2013-07-22","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2013-2248","description":"Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.","exploit_maturity":"Working exploit published","published":"2013-07-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-3803","description":"Unspecified vulnerability in the Hyperion BI+ component in Oracle Hyperion 11.1.1.3, 11.1.1.4.107 and earlier, 11.1.2.1.129 and earlier, and 11.1.2.2.305 and earlier allows remote authenticated users to affect confidentiality via unknown vectors related to Intelligence Service.","exploit_maturity":"Working exploit published","published":"2013-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2013-3763","description":"Unspecified vulnerability in the Oracle Endeca Server component in Oracle Fusion Middleware 7.4.0 and 7.5.1.1 allows remote authenticated users to affect confidentiality and integrity via unknown vectors, a different vulnerability than CVE-2013-3764.","exploit_maturity":"Working exploit published","published":"2013-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-2134","description":"Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.","exploit_maturity":"Working exploit published","published":"2013-07-16","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2013-2115","description":"Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.","exploit_maturity":"Working exploit published","published":"2013-07-10","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2013-1966","description":"Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.","exploit_maturity":"Working exploit published","published":"2013-07-10","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2013-1965","description":"Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.","exploit_maturity":"Working exploit published","published":"2013-07-10","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2013-2472","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to \"Incorrect ShortBandedRaster size checks\" in 2D.","exploit_maturity":"Working exploit published","published":"2013-06-18","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2013-2470","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to \"ImagingLib byte lookup processing.\"","exploit_maturity":"Working exploit published","published":"2013-06-18","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2013-2460","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Serviceability.  NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to \"insufficient access checks\" in the tracing component.","exploit_maturity":"Working exploit published","published":"2013-06-18","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2013-0140","description":"SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.","exploit_maturity":"Working exploit published","published":"2013-05-01","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2013-2419","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect availability via unknown vectors related to 2D.  NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to \"font processing errors\" in the International Components for Unicode (ICU) Layout Engine before 51.2.","exploit_maturity":"Working exploit published","published":"2013-04-17","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"},
  {"cve_id":"CVE-2013-1559","description":"Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors related to Content Server.","exploit_maturity":"Working exploit published","published":"2013-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-1509","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 7.6.2, 11.1.1.6.0, and 11.1.1.6.1 allows remote authenticated users to affect integrity via unknown vectors related to WebCenter Sites.","exploit_maturity":"Working exploit published","published":"2013-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-1814","description":"The users/get program in the User RPC API in Apache Rave 0.11 through 0.20 allows remote authenticated users to obtain sensitive information about all user accounts via the offset parameter, as demonstrated by discovering password hashes in the password field of a response.","exploit_maturity":"Working exploit published","published":"2013-03-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2013-1488","description":"The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 6 and 7, allows remote attackers to execute arbitrary code via unspecified vectors involving reflection, Libraries, \"improper toString calls,\" and the JDBC driver manager, as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.","exploit_maturity":"Working exploit published","published":"2013-03-08","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2013-1493","description":"The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.","exploit_maturity":"Working exploit published","published":"2013-03-05","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2013-0397","description":"Unspecified vulnerability in the Oracle Applications Framework component in Oracle E-Business Suite 11.5.10.2, 12.0.6, and 12.1.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Diagnostics.","exploit_maturity":"Working exploit published","published":"2013-01-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2011-2732","description":"CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.","exploit_maturity":"Working exploit published","published":"2012-12-05","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-3186","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a different vulnerability than CVE-2012-3183 and CVE-2012-3185.","exploit_maturity":"Working exploit published","published":"2012-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-3185","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a different vulnerability than CVE-2012-3183 and CVE-2012-3186.","exploit_maturity":"Working exploit published","published":"2012-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-3184","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote attackers to affect integrity via unknown vectors related to Advanced UI.","exploit_maturity":"Working exploit published","published":"2012-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-3183","description":"Unspecified vulnerability in the Oracle WebCenter Sites component in Oracle Fusion Middleware 6.1, 6.2, 6.3.x, 7, 7.0.1, 7.0.2, 7.0.3, 7.5, 7.6.1, 7.6.2, and 11.1.1.6.0 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Advanced UI, a different vulnerability than CVE-2012-3185 and CVE-2012-3186.","exploit_maturity":"Working exploit published","published":"2012-10-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-5088","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries.","exploit_maturity":"Working exploit published","published":"2012-10-16","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2012-3153","description":"Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet.  NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions.  NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.","exploit_maturity":"Working exploit published","published":"2012-10-16","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2011-5167","description":"Heap-based buffer overflow in the SetDevNames method of the Tidestone Formula One ActiveX control (TTF16.ocx) 6.3.5 Build 1 in Oracle Hyperion Strategic Finance 12.x and possibly earlier allows remote attackers to execute arbitrary code via a long string to the DriverName parameter.","exploit_maturity":"Working exploit published","published":"2012-09-15","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2012-0547","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier, and 6 Update 34 and earlier, has no impact and remote attack vectors involving AWT and \"a security-in-depth issue that is not directly exploitable but which can be used to aggravate security vulnerabilities that can be directly exploited.\" NOTE: this identifier was assigned by the Oracle CNA, but CVE is not intended to cover defense-in-depth issues that are only exposed by the presence of other vulnerabilities.  NOTE: Oracle has not commented on claims from a downstream vendor that this issue is related to \"toolkit internals references.\"","exploit_maturity":"Working exploit published","published":"2012-08-30","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2012-1770","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1769, CVE-2012-1771, CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110.","exploit_maturity":"Working exploit published","published":"2012-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2012-1769","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2012-1766, CVE-2012-1767, CVE-2012-1770, CVE-2012-1771, CVE-2012-1772, CVE-2012-1773, CVE-2012-3106, CVE-2012-3107, CVE-2012-3108, and CVE-2012-3110.","exploit_maturity":"Working exploit published","published":"2012-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2012-1744","description":"Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.5 and 8.3.7 allows context-dependent users to affect availability via unknown vectors related to Outside In Filters.","exploit_maturity":"Working exploit published","published":"2012-07-17","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2012-2138","description":"The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.","exploit_maturity":"Working exploit published","published":"2012-07-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-0551","description":"Unspecified vulnerability in the Java Runtime Environment (JRE) in Oracle Java SE 7 update 4 and earlier and 6 update 32 and earlier, and the GlassFish Enterprise Server component in Oracle Sun Products Suite GlassFish Enterprise Server 3.1.1, allows remote attackers to affect confidentiality and integrity via unknown vectors related to Web Container or Deployment.","exploit_maturity":"Working exploit published","published":"2012-05-03","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"},
  {"cve_id":"CVE-2012-0549","description":"Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related to Desktop API.","exploit_maturity":"Working exploit published","published":"2012-05-03","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2012-1007","description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML via (1) the name parameter to struts-examples/upload/upload-submit.do, or the message parameter to (2) struts-cookbook/processSimple.do or (3) struts-cookbook/processDyna.do.","exploit_maturity":"Working exploit published","published":"2012-02-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-1006","description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.0.14 and 2.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) lastName parameter to struts2-showcase/person/editPerson.action, or the (3) clientName parameter to struts2-rest-showcase/orders.","exploit_maturity":"Working exploit published","published":"2012-02-07","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-0393","description":"The ParameterInterceptor component in Apache Struts before 2.3.1.1 does not prevent access to public constructors, which allows remote attackers to create or overwrite arbitrary files via a crafted parameter that triggers the creation of a Java object.","exploit_maturity":"Working exploit published","published":"2012-01-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2012-0392","description":"The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.","exploit_maturity":"Working exploit published","published":"2012-01-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2011-5057","description":"Apache Struts 2.3.1.2 and earlier, 2.3.19-2.3.23, provides interfaces that do not properly restrict access to collections such as the session and request collections, which might allow remote attackers to modify run-time data values via a crafted parameter to an application that implements an affected interface, as demonstrated by the SessionAware, RequestAware, ApplicationAware, ServletRequestAware, ServletResponseAware, and ParameterAware interfaces. NOTE: the vendor disputes the significance of this report because of an \"easy work-around in existing apps by configuring the interceptor.\"","exploit_maturity":"Working exploit published","published":"2012-01-08","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2011-4858","description":"Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","exploit_maturity":"Working exploit published","published":"2012-01-05","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2011-5034","description":"Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.  NOTE: this might overlap CVE-2011-4461.","exploit_maturity":"Working exploit published","published":"2011-12-30","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2011-3556","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7, 6 Update 27 and earlier, 5.0 Update 31 and earlier, 1.4.2_33 and earlier, and JRockit R28.1.4 and earlier allows remote attackers to affect confidentiality, integrity, and availability, related to RMI, a different vulnerability than CVE-2011-3557.","exploit_maturity":"Working exploit published","published":"2011-10-19","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2010-3271","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.","exploit_maturity":"Working exploit published","published":"2011-07-18","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2011-1772","description":"Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3, and OpenSymphony XWork in OpenSymphony WebWork, allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name, (2) the action attribute of an s:submit element, or (3) the method attribute of an s:submit element.","exploit_maturity":"Working exploit published","published":"2011-05-13","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2011-1571","description":"Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.","exploit_maturity":"Working exploit published","published":"2011-05-07","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2011-0836","description":"Unspecified vulnerability in Oracle JD Edwards EnterpriseOne Tools 8.9 GA through 8.98.4.1 and OneWorld Tools through 24.1.3 allows remote authenticated users to affect integrity, related to Web Runtime SEC.","exploit_maturity":"Working exploit published","published":"2011-04-20","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2011-0807","description":"Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration.","exploit_maturity":"Working exploit published","published":"2011-04-20","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2010-4476","description":"The Double.parseDouble method in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier, 5.0 Update 27 and earlier, and 1.4.2_29 and earlier, as used in OpenJDK, Apache, JBossweb, and other products, allows remote attackers to cause a denial of service via a crafted string that triggers an infinite loop of estimations during conversion to a double-precision binary floating-point number, as demonstrated using 2.2250738585072012e-308.","exploit_maturity":"Working exploit published","published":"2011-02-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2010-4452","description":"Unspecified vulnerability in the Deployment component in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"Working exploit published","published":"2011-02-17","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2010-4437","description":"Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 9.0, 9.1, 9.2.4, 10.0.2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet Container.","exploit_maturity":"Working exploit published","published":"2011-01-19","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2010-4417","description":"Unspecified vulnerability in the Services for Beehive component in Oracle Fusion Middleware 2.0.1.0, 2.0.1.1, 2.0.1.2, 2.0.1.2.1, and 2.0.1.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the January 2011 CPU.  Oracle has not commented on claims from a reliable third party coordinator that voice-servlet/prompt-qa/Index.jspf does not properly handle null (%00) bytes in the evaluation parameter that is used in a filename, which allows attackers to create a file with an executable extension and execute arbitrary JSP code.","exploit_maturity":"Working exploit published","published":"2011-01-19","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2010-3595","description":"Unspecified vulnerability in the Oracle Document Capture component in Oracle Fusion Middleware 10.1.3.4 and 10.1.3.5 allows remote attackers to affect confidentiality via unknown vectors related to Import Server.  NOTE: the previous information was obtained from the January 2011 CPU.  Oracle has not commented on claims from the original researcher that remote attackers can read arbitrary files via a full pathname in the first argument to the ImportBodyText method in the EasyMail ActiveX control (emsmtp.dll).","exploit_maturity":"Working exploit published","published":"2011-01-19","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2010-4172","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Manager application in Apache Tomcat 6.0.12 through 6.0.29 and 7.0.0 through 7.0.4 allow remote attackers to inject arbitrary web script or HTML via the (1) orderBy or (2) sort parameter to sessionsList.jsp, or unspecified input to (3) sessionDetail.jsp or (4) java/org/apache/catalina/manager/JspHelper.java, related to use of untrusted web applications.","exploit_maturity":"Working exploit published","published":"2010-11-26","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2010-3863","description":"Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.","exploit_maturity":"Working exploit published","published":"2010-11-05","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2010-3573","description":"Unspecified vulnerability in the Networking component in Oracle Java SE and Java for Business 6 Update 21 and 5.0 Update 25 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the October 2010 CPU.  Oracle has not commented on claims from a reliable downstream vendor that this is related to missing validation of request headers in the HttpURLConnection class when they are set by applets, which allows remote attackers to bypass the intended security policy.","exploit_maturity":"Working exploit published","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"Medium"},
  {"cve_id":"CVE-2010-3563","description":"Unspecified vulnerability in the Deployment component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the October 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is related to \"how Web Start retrieves security policies,\" BasicServiceImpl, and forged policies that bypass sandbox restrictions.","exploit_maturity":"Working exploit published","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2010-3552","description":"Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"Working exploit published","published":"2010-10-19","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2010-3581","description":"Unspecified vulnerability in the BPEL Console component in Oracle Fusion Middleware 11.1.1.1.0 and 11.1.1.2.0 allows remote authenticated users to affect integrity via unknown vectors.","exploit_maturity":"Working exploit published","published":"2010-10-14","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2010-1870","description":"The OGNL extensive expression evaluation capability in XWork in Struts 2.0.0 through 2.1.8.1, as used in Atlassian Fisheye, Crucible, and possibly other products, uses a permissive whitelist, which allows remote attackers to modify server-side context objects and bypass the \"#\" protection mechanism in ParameterInterceptors via the (1) #context, (2) #_memberAccess, (3) #root, (4) #this, (5) #_typeResolver, (6) #_classResolver, (7) #_traceEvaluations, (8) #_lastEvaluation, (9) #_keepLastEvaluation, and possibly other OGNL context variables, a different vulnerability than CVE-2008-6504.","exploit_maturity":"Working exploit published","published":"2010-08-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2010-2375","description":"Package/Privilege: Plugins for Apache, Sun and IIS web servers Unspecified vulnerability in the WebLogic Server component in Oracle Fusion Middleware 7.0 SP7, 8.1 SP6, 9.0, 9.1, 9.2 MP3, 10.0 MP2, 10.3.2, and 10.3.3 allows remote attackers to affect confidentiality and integrity, related to IIS.","exploit_maturity":"Working exploit published","published":"2010-07-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2010-2370","description":"Unspecified vulnerability in the Oracle Business Process Management component in Oracle Fusion Middleware 5.7 MP3, 6.0 MP5, and 10.3 MP2 allows remote attackers to affect integrity, related to BPM.","exploit_maturity":"Working exploit published","published":"2010-07-13","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2010-1622","description":"SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.","exploit_maturity":"Working exploit published","published":"2010-06-21","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2010-2103","description":"Cross-site scripting (XSS) vulnerability in axis2-admin/axis2-admin/engagingglobally in the administration console in Apache Axis2/Java 1.4.1, 1.5.1, and possibly other versions, as used in SAP Business Objects 12, 3com IMC, and possibly other products, allows remote attackers to inject arbitrary web script or HTML via the modules parameter.  NOTE: some of these details are obtained from third party information.","exploit_maturity":"Working exploit published","published":"2010-05-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2010-1587","description":"The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.","exploit_maturity":"Working exploit published","published":"2010-04-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2010-1157","description":"Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the WWW-Authenticate header in the reply.","exploit_maturity":"Working exploit published","published":"2010-04-23","resolved":"MITIGATION-CANDIDATE","severity":"Low"},
  {"cve_id":"CVE-2010-0886","description":"Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.","exploit_maturity":"Working exploit published","published":"2010-04-20","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2010-1423","description":"Argument injection vulnerability in the URI handler in (a) Java NPAPI plugin and (b) Java Deployment Toolkit in Java 6 Update 10, 19, and other versions, when running on Windows and possibly on Linux, allows remote attackers to execute arbitrary code via the (1) -J or (2) -XXaltjvm argument to javaws.exe, which is processed by the launch method.  NOTE: some of these details are obtained from third party information.","exploit_maturity":"Working exploit published","published":"2010-04-15","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2010-0842","description":"Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.","exploit_maturity":"Working exploit published","published":"2010-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2010-0838","description":"Unspecified vulnerability in the Java 2D component in Oracle Java SE and Java for Business 6 Update 18, 5.0, Update, and 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is a stack-based buffer overflow using an untrusted size value in the readMabCurveData function in the CMM module in the JVM.","exploit_maturity":"Working exploit published","published":"2010-04-01","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2010-0094","description":"Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.  NOTE: the previous information was obtained from the March 2010 CPU.  Oracle has not commented on claims from a reliable researcher that this is due to missing privilege checks during deserialization of RMIConnectionImpl objects, which allows remote attackers to call system-level Java functions via the ClassLoader of a constructor that is being deserialized.","exploit_maturity":"Working exploit published","published":"2010-04-01","resolved":"MITIGATED-BY-ENVIRONMENT","severity":"High"},
  {"cve_id":"CVE-2009-3548","description":"The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 through 5.5.28, and possibly earlier versions uses a blank default password for the administrative user, which allows remote attackers to gain privileges.","exploit_maturity":"Working exploit published","published":"2009-11-12","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2009-3869","description":"Stack-based buffer overflow in the setDiffICM function in the Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a crafted argument, aka Bug Id 6872357.","exploit_maturity":"Working exploit published","published":"2009-11-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-3867","description":"Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.","exploit_maturity":"Working exploit published","published":"2009-11-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-1955","description":"The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.","exploit_maturity":"Working exploit published","published":"2009-06-08","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2009-0580","description":"Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed URL encoding of passwords, related to improper error checking in the (1) MemoryRealm, (2) DataSourceRealm, and (3) JDBCRealm authentication realms, as demonstrated by a % (percent) value for the j_password parameter.","exploit_maturity":"Working exploit published","published":"2009-06-05","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2009-1595","description":"The jabber:iq:auth implementation in IQAuthHandler.java in Ignite Realtime Openfire before 3.6.4 allows remote authenticated users to change the passwords of arbitrary accounts via a modified username element in a passwd_change action.","exploit_maturity":"Working exploit published","published":"2009-05-11","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2009-1523","description":"Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.","exploit_maturity":"Working exploit published","published":"2009-05-05","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2009-0039","description":"Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.","exploit_maturity":"Working exploit published","published":"2009-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2009-0038","description":"Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.","exploit_maturity":"Working exploit published","published":"2009-04-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2008-5518","description":"Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.","exploit_maturity":"Working exploit published","published":"2009-04-17","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2008-6505","description":"Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.","exploit_maturity":"Working exploit published","published":"2009-03-23","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2008-6504","description":"ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \\u0023 representation for the # character.","exploit_maturity":"Working exploit published","published":"2009-03-23","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2009-0855","description":"Cross-site scripting (XSS) vulnerability in the administrative console in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.23 on z/OS allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.","exploit_maturity":"Working exploit published","published":"2009-03-09","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2009-0026","description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Jackrabbit before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the q parameter to (1) search.jsp or (2) swr.jsp.","exploit_maturity":"Working exploit published","published":"2009-01-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2008-5353","description":"The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by \"deserializing Calendar objects\".","exploit_maturity":"Working exploit published","published":"2008-12-05","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2008-5266","description":"Cross-site scripting (XSS) vulnerability in configuration/httpListenerEdit.jsf in the GlassFish 2 UR2 b04 webadmin interface in Sun Java System Application Server 9.1_01 build b09d-fcs and 9.1_02 build b04-fcs allows remote attackers to inject arbitrary web script or HTML via the name parameter, a different vector than CVE-2008-2751.","exploit_maturity":"Working exploit published","published":"2008-11-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2008-2938","description":"Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370.  NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.","exploit_maturity":"Working exploit published","published":"2008-08-13","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2008-2370","description":"Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.","exploit_maturity":"Working exploit published","published":"2008-08-04","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2008-1232","description":"Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16 allows remote attackers to inject arbitrary web script or HTML via a crafted string that is used in the message argument to the HttpServletResponse.sendError method.","exploit_maturity":"Working exploit published","published":"2008-08-04","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2008-2751","description":"Multiple cross-site scripting (XSS) vulnerabilities in the Glassfish webadmin interface in Sun Java System Application Server 9.1_01 allow remote attackers to inject arbitrary web script or HTML via the (1) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (2) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (3) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, or (4) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (a) resourceNode/customResourceNew.jsf; the (5) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiProp:JndiNew, (6) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:resTypeProp:resType, (7) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:factoryClassProp:factoryClass, (8) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:jndiLookupProp:jndiLookup, or (9) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:descProp:desc parameter to (b) resourceNode/externalResourceNew.jsf; the (10) propertyForm:propertySheet:propertSectionTextField:jndiProp:Jndi, (11) propertyForm:propertySheet:propertSectionTextField:nameProp:name, or (12) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (c) resourceNode/jmsDestinationNew.jsf; the (13) propertyForm:propertySheet:generalPropertySheet:jndiProp:Jndi or (14) propertyForm:propertySheet:generalPropertySheet:descProp:cd parameter to (d) resourceNode/jmsConnectionNew.jsf; the (15) propertyForm:propertySheet:propertSectionTextField:jndiProp:jnditext or (16) propertyForm:propertySheet:propertSectionTextField:descProp:desc parameter to (e) resourceNode/jdbcResourceNew.jsf; the (17) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:nameProp:name, (18) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:classNameProp:classname, or (19) propertyForm:propertyContentPage:propertySheet:propertSectionTextField:loadOrderProp:loadOrder parameter to (f) applications/lifecycleModulesNew.jsf; or the (20) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:jndiProp:name, (21) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:resTypeProp:resType, or (22) propertyForm:propertyContentPage:propertySheet:generalPropertySheet:dbProp:db parameter to (g) resourceNode/jdbcConnectionPoolNew1.jsf.","exploit_maturity":"Working exploit published","published":"2008-06-18","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2008-1510","description":"Cross-site scripting (XSS) vulnerability in system/workplace/admin/accounts/users_list.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the (1) searchfilter or (2) listSearchFilter parameter.","exploit_maturity":"Working exploit published","published":"2008-03-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2008-1357","description":"Format string vulnerability in the logDetail function of applib.dll in McAfee Common Management Agent (CMA) 3.6.0.574 (Patch 3) and earlier, as used in ePolicy Orchestrator 4.0.0 build 1015, allows remote attackers to cause a denial of service (crash) or execute arbitrary code via format string specifiers in a sender field in an AgentWakeup request to UDP port 8082.  NOTE: this issue only exists when the debug level is 8.","exploit_maturity":"Working exploit published","published":"2008-03-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2008-1301","description":"Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter.","exploit_maturity":"Working exploit published","published":"2008-03-12","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2008-1300","description":"Cross-site scripting (XSS) vulnerability in the Logfile Viewer Settings function in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote attackers to inject arbitrary web script or HTML via the filePath.0 parameter in a save action, a different vector than CVE-2008-1045.","exploit_maturity":"Working exploit published","published":"2008-03-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2008-1193","description":"Unspecified vulnerability in Java Runtime Environment Image Parsing Library in Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier, allows remote attackers to gain privileges via an untrusted application.","exploit_maturity":"Working exploit published","published":"2008-03-06","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2008-1045","description":"Cross-site scripting (XSS) vulnerability in the file tree navigation function in system/workplace/views/explorer/tree_files.jsp in Alkacon OpenCMS 7.0.3 allows remote attackers to inject arbitrary web script or HTML via the resource parameter.","exploit_maturity":"Working exploit published","published":"2008-02-27","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-5333","description":"Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (\") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause sensitive information such as session IDs to be leaked to remote attackers and enable session hijacking attacks.  NOTE: this issue exists because of an incomplete fix for CVE-2007-3385.","exploit_maturity":"Working exploit published","published":"2008-02-12","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-5944","description":"Cross-site scripting (XSS) vulnerability in Servlet Engine / Web Container in IBM WebSphere Application Server (WAS) 5.1.1.4 through 5.1.1.16 allows remote attackers to inject arbitrary web script or HTML via the Expect HTTP header.  NOTE: this might be the same issue as CVE-2006-3918, but there are insufficient details to be sure.","exploit_maturity":"Working exploit published","published":"2007-11-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-5461","description":"Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.","exploit_maturity":"Working exploit published","published":"2007-10-15","resolved":"MITIGATED-BY-RASP","severity":"Low"},
  {"cve_id":"CVE-2007-5019","description":"Buffer overflow in the Sun Java Web Start ActiveX control in Java Runtime Environment (JRE) 1.6.0_X allows remote attackers to have an unknown impact via a long argument to the dnsResolve (isInstalled.dnsResolve) method.","exploit_maturity":"Working exploit published","published":"2007-09-20","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2007-4556","description":"Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a \"%{\" sequence and ending with a \"}\" character.","exploit_maturity":"Working exploit published","published":"2007-08-28","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-4381","description":"Unspecified vulnerability in the font parsing implementation in Sun JDK and JRE 5.0 Update 9 and earlier, and SDK and JRE 1.4.2_14 and earlier, allows remote attackers to perform unauthorized actions via an applet that grants certain privileges to itself.","exploit_maturity":"Working exploit published","published":"2007-08-17","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2007-3386","description":"Cross-site scripting (XSS) vulnerability in the Host Manager Servlet for Apache Tomcat 6.0.0 to 6.0.13 and 5.5.0 to 5.5.24 allows remote attackers to inject arbitrary HTML and web script via crafted requests, as demonstrated using the aliases parameter to an html/add action.","exploit_maturity":"Working exploit published","published":"2007-08-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-3382","description":"Apache Tomcat 6.0.0 to 6.0.13, 5.5.0 to 5.5.24, 5.0.0 to 5.0.30, 4.1.0 to 4.1.36, and 3.3 to 3.3.2 treats single quotes (\"'\") as delimiters in cookies, which might cause sensitive information such as session IDs to be leaked and allow remote attackers to conduct session hijacking attacks.","exploit_maturity":"Working exploit published","published":"2007-08-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-3655","description":"Stack-based buffer overflow in javaws.exe in Sun Java Web Start in JRE 5.0 Update 11 and earlier, and 6.0 Update 1 and earlier, allows remote attackers to execute arbitrary code via a long codebase attribute in a JNLP file.","exploit_maturity":"Working exploit published","published":"2007-07-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-2449","description":"Multiple cross-site scripting (XSS) vulnerabilities in certain JSP files in the examples web application in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.24, and 6.0.0 through 6.0.13 allow remote attackers to inject arbitrary web script or HTML via the portion of the URI after the ';' character, as demonstrated by a URI containing a \"snp/snoop.jsp;\" sequence.","exploit_maturity":"Working exploit published","published":"2007-06-14","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-1355","description":"Multiple cross-site scripting (XSS) vulnerabilities in the appdev/sample/web/hello.jsp example application in Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.36, 5.0.0 through 5.0.30, 5.5.0 through 5.5.23, and 6.0.0 through 6.0.10 allow remote attackers to inject arbitrary web script or HTML via the test parameter and unspecified vectors.","exploit_maturity":"Working exploit published","published":"2007-05-21","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2006-7196","description":"Cross-site scripting (XSS) vulnerability in the calendar application example in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0 through 4.1.31, 5.0.0 through 5.0.30, and 5.5.0 through 5.5.15 allows remote attackers to inject arbitrary web script or HTML via the time parameter to cal2.jsp and possibly unspecified other vectors.  NOTE: this may be related to CVE-2006-0254.1.","exploit_maturity":"Working exploit published","published":"2007-05-10","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-2353","description":"Apache Axis 1.0 allows remote attackers to obtain sensitive information by requesting a non-existent WSDL file, which reveals the installation path in the resulting exception message.","exploit_maturity":"Working exploit published","published":"2007-04-30","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2007-0297","description":"Unspecified vulnerability in Oracle PeopleSoft Enterprise and JD Edwards EnterpriseOne 8.47.11 and 8.48.06 has unknown impact and attack vectors in PeopleTools, aka PSE03.","exploit_maturity":"Working exploit published","published":"2007-01-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2006-3835","description":"Apache Tomcat 5 before 5.5.17 allows remote attackers to list directories via a semicolon (;) preceding a filename with a mapped extension, as demonstrated by URLs ending with /;index.jsp and /;help.do.","exploit_maturity":"Working exploit published","published":"2006-07-25","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2006-2758","description":"Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded ../) in the URL.  NOTE: this might be the same issue as CVE-2005-3747.","exploit_maturity":"Working exploit published","published":"2006-06-02","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2006-2431","description":"Cross-site scripting (XSS) vulnerability in the 500 Internal Server Error page on the SOAP port (8880/tcp) in IBM WebSphere Application Server 5.0.2 and earlier, 5.1.x before 5.1.1.12, and 6.0.2 up to 6.0.2.7, allows remote attackers to inject arbitrary web script or HTML via the URI, which is contained in a FAULTACTOR element on this page.  NOTE: some sources have reported the element as \"faultfactor,\" but this is likely erroneous.","exploit_maturity":"Working exploit published","published":"2006-05-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2006-2426","description":"Sun Java Runtime Environment (JRE) 1.5.0_6 and earlier, JDK 1.5.0_6 and earlier, and SDK 1.5.0_6 and earlier allows remote attackers to cause a denial of service (disk consumption) by using the Font.createFont function to create temporary files of arbitrary size in the %temp% directory.","exploit_maturity":"Working exploit published","published":"2006-05-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2006-0254","description":"Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.","exploit_maturity":"Working exploit published","published":"2006-01-18","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2005-4703","description":"Apache Tomcat 4.0.3, when running on Windows, allows remote attackers to obtain sensitive information via a request for a file that contains an MS-DOS device name such as lpt9, which leaks the pathname in an error message, as demonstrated by lpt9.xtp using Nikto.","exploit_maturity":"Working exploit published","published":"2005-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2005-3747","description":"Unspecified vulnerability in Jetty before 5.1.6 allows remote attackers to obtain source code of JSP pages, possibly involving requests for .jsp files with URL-encoded backslash (\"%5C\") characters.  NOTE: this might be the same issue as CVE-2006-2758.","exploit_maturity":"Working exploit published","published":"2005-11-22","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2005-3745","description":"Cross-site scripting (XSS) vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML via the query string, which is not properly quoted or filtered when the request handler generates an error message.","exploit_maturity":"Working exploit published","published":"2005-11-22","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2005-1112","description":"IBM WebSphere Application Server 6.0 and earlier, when sharing the document root of the web server, allows remote attackers to obtain the source code for Java Server Pages (.jsp) via an HTTP request with an invalid Host header, which causes the page to be processed by the web server instead of the JSP engine.","exploit_maturity":"Working exploit published","published":"2005-05-02","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2004-2115","description":"Multiple cross-site scripting (XSS) vulnerabilities in Oracle HTTP Server 1.3.22, based on Apache, allow remote attackers to execute arbitrary script as other users via the (1) action, (2) username, or (3) password parameters in an isqlplus request.","exploit_maturity":"Working exploit published","published":"2004-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2004-1364","description":"Directory traversal vulnerability in extproc in Oracle 9i and 10g allows remote attackers to access arbitrary libraries outside of the $ORACLE_HOME\\bin directory.","exploit_maturity":"Working exploit published","published":"2004-08-04","resolved":"MITIGATED-BY-RASP","severity":"High"},
  {"cve_id":"CVE-2004-0095","description":"McAfee ePolicy Orchestrator agent allows remote attackers to cause a denial of service (memory consumption and crash) and possibly execute arbitrary code via an HTTP POST request with an invalid Content-Length value, possibly triggering a buffer overflow.","exploit_maturity":"Working exploit published","published":"2004-02-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2003-1123","description":"Sun Java Runtime Environment (JRE) and SDK 1.4.0_01 and earlier allows untrusted applets to access certain information within trusted applets, which allows attackers to bypass the restrictions of the Java security model.","exploit_maturity":"Working exploit published","published":"2003-12-31","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2003-0896","description":"The loadClass method of the sun.applet.AppletClassLoader class in the Java Virtual Machine (JVM) in Sun SDK and JRE 1.4.1_03 and earlier allows remote attackers to bypass sandbox restrictions and execute arbitrary code via a loaded class name that contains \"/\" (slash) instead of \".\" (dot) characters, which bypasses a call to the Security Manager's checkPackageAccess method.","exploit_maturity":"Working exploit published","published":"2003-11-17","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2003-0866","description":"The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.","exploit_maturity":"Working exploit published","published":"2003-11-17","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2002-1567","description":"Cross-site scripting (XSS) vulnerability in Apache Tomcat 4.1 allows remote attackers to execute arbitrary web script and steal cookies via a URL with encoded newlines followed by a request to a .jsp file whose name contains the script.","exploit_maturity":"Working exploit published","published":"2003-10-06","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2002-1533","description":"Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote attackers to insert arbitrary HTML or script via an HTTP request to a .jsp file whose name contains the malicious script and some encoded linefeed characters (%0a).","exploit_maturity":"Working exploit published","published":"2003-03-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2003-0042","description":"Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.","exploit_maturity":"Working exploit published","published":"2003-02-07","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2002-2272","description":"Tomcat 4.0 through 4.1.12, using mod_jk 1.2.1 module on Apache 1.3 through 1.3.27, allows remote attackers to cause a denial of service (desynchronized communications) via an HTTP GET request with a Transfer-Encoding chunked field with invalid values.","exploit_maturity":"Working exploit published","published":"2002-12-31","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2002-2072","description":"java.security.AccessController in Sun Java Virtual Machine (JVM) in JRE 1.2.2 and 1.3.1 allows remote attackers to cause a denial of service (JVM crash) via a Java program that calls the doPrivileged method with a null argument.","exploit_maturity":"Working exploit published","published":"2002-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2002-2007","description":"The default installations of Apache Tomcat 3.2.3 and 3.2.4 allows remote attackers to obtain sensitive system information such as directory listings and web root path, via erroneous HTTP requests for Java Server Pages (JSP) in the (1) test/jsp, (2) samples/jsp and (3) examples/jsp directories, or the (4) test/realPath.jsp servlet, which leaks pathnames in error messages.","exploit_maturity":"Working exploit published","published":"2002-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2002-2006","description":"The default installation of Apache Tomcat 4.0 through 4.1 and 3.0 through 3.3.1 allows remote attackers to obtain the installation path and other sensitive system information via the (1) SnoopServlet or (2) TroubleShooter example servlets.","exploit_maturity":"Working exploit published","published":"2002-12-31","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2002-1148","description":"The default servlet (org.apache.catalina.servlets.DefaultServlet) in Tomcat 4.0.4 and 4.1.10 and earlier allows remote attackers to read source code for server files via a direct request to the servlet.","exploit_maturity":"Working exploit published","published":"2002-10-11","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2002-1042","description":"Directory traversal vulnerability in search engine for iPlanet web server 6.0 SP2 and 4.1 SP9, and Netscape Enterprise Server 3.6, when running on Windows platforms, allows remote attackers to read arbitrary files via ..\\ (dot-dot backslash) sequences in the NS-query-pat parameter.","exploit_maturity":"Working exploit published","published":"2002-10-04","resolved":"MITIGATED-BY-RASP","severity":"Medium"},
  {"cve_id":"CVE-2002-0936","description":"The Java Server Pages (JSP) engine in Tomcat allows web page owners to cause a denial of service (engine crash) on the web server via a JSP page that calls WPrinterJob().pageSetup(null,null).","exploit_maturity":"Working exploit published","published":"2002-10-04","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2002-0682","description":"Cross-site scripting vulnerability in Apache Tomcat 4.0.3 allows remote attackers to execute script as other web users via script in a URL with the /servlet/ mapping, which does not filter the script when an exception is thrown by the servlet.","exploit_maturity":"Working exploit published","published":"2002-07-23","resolved":"MITIGATION-CANDIDATE","severity":"High"},
  {"cve_id":"CVE-2001-0590","description":"Apache Software Foundation Tomcat Servlet prior to 3.2.2 allows a remote attacker to read the source code to arbitrary 'jsp' files via a malformed URL request which does not end with an HTTP protocol specification (i.e. HTTP/1.0).","exploit_maturity":"Working exploit published","published":"2001-08-02","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2001-0390","description":"IBM Websphere/NetCommerce3 3.1.2 allows remote attackers to cause a denial of service by directly calling the macro.d2w macro with a long string of %0a characters.","exploit_maturity":"Working exploit published","published":"2001-07-02","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2000-0760","description":"The Snoop servlet in Jakarta Tomcat 3.1 and 3.0 under Apache reveals sensitive system information when a remote attacker requests a nonexistent URL with a .snp extension.","exploit_maturity":"Working exploit published","published":"2000-10-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2000-0759","description":"Jakarta Tomcat 3.1 under Apache reveals physical path information when a remote attacker requests a URL that does not exist, which generates an error message that includes the physical path.","exploit_maturity":"Working exploit published","published":"2000-10-20","resolved":"MITIGATION-CANDIDATE","severity":"Medium"},
  {"cve_id":"CVE-2000-0652","description":"IBM WebSphere allows remote attackers to read source code for executable web files by directly calling the default InvokerServlet using a URL which contains the \"/servlet/file\" string.","exploit_maturity":"Working exploit published","published":"2000-07-24","resolved":"MITIGATION-CANDIDATE","severity":"Medium"}
]