getahead vulnerabilities

Products

• direct web remoting 4

Latest getahead CVEs

Newest publication first

1. CVE-2007-2377 The Getahead Direct Web Remoting (DWR) framework 1.1.4 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data....

   Published 2007-04-30

   Medium·CVSS 5.0 EPSS 1.9%

   The Getahead Direct Web Remoting (DWR) framework 1.1.4 exchanges data using JavaScript Object Notation (JSON) without an associated protection scheme, which allows remote attackers to obtain the data via a web page that retrieves the data through a URL in the SRC attribute of a S...

2. CVE-2006-6916 Getahead Direct Web Remoting (DWR) before 1.1.3 allows attackers to cause a denial of service (infinite loop) via unknown vectors related to "crafted input."

   Published 2007-01-11

   High·CVSS 7.5 EPSS 3.1%

   Getahead Direct Web Remoting (DWR) before 1.1.3 allows attackers to cause a denial of service (infinite loop) via unknown vectors related to "crafted input."

3. CVE-2007-0185 Direct Web Remoting vulnerable to Denial of Service

   Published 2007-01-11

   Medium·CVSS 5.0 EPSS 1.5%

   Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to cause a denial of service (memory exhaustion and servlet outage) via unknown vectors related to a large number of calls in a batch.

4. CVE-2007-0184 Incorrect Authorization in Getahead Direct Web Remoting

   Published 2007-01-11

   High·CVSS 7.5 EPSS 1.5%

   Getahead Direct Web Remoting (DWR) before 1.1.4 allows attackers to obtain unauthorized access to public methods via a crafted request that bypasses the include/exclude checks.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.