CVE-2003-0621 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	4.19%	–	–
2022-04-03	–	–	4.19%	–	–
2022-07-17	–	–	4.19%	–	–
2023-03-12	–	–	–	1.08%	–
2023-05-14	–	–	–	1%	–
2023-07-02	–	–	–	1%	–
2024-02-11	–	–	–	1%	–
2024-06-02	–	–	–	0.81%	–
2024-09-08	–	–	–	0.8%	–
2024-12-22	–	–	–	0.9%	–
2025-01-05	–	–	–	0.9%	–
2025-01-19	–	–	–	0.9%	–
2025-03-18	–	–	–	–	6.82%
2025-03-30	–	–	–	–	6.82%
2025-04-11	–	–	–	–	6.82%
2025-04-13	–	–	–	–	6.82%
2025-04-15	–	–	–	–	6.82%
2025-04-15	–	–	–	–	6.82,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	7%
2022-04-03	86%
2022-07-17	87%
2023-03-12	82%
2023-05-14	81%
2023-07-02	82%
2024-02-11	83%
2024-06-02	82%
2024-09-08	82%
2024-12-22	82%
2025-01-05	83%
2025-01-19	83%
2025-03-18	91%
2025-03-30	9%
2025-04-11	91%
2025-04-13	9%
2025-04-15	91%
2025-04-15	91%

source: https://www.securityfocus.com/bid/8931/info A vulnerability has reported to exist in BEA Tuxedo and WebLogic Enterprise due to Tuxedo administration console. The script is reported to accept various initialization arguments such as INIFILE that are not properly sanitized for user-supplied input. This issue may allow an attacker to carry out attacks such as denial of service, file disclosure, and cross-site scripting. An attacker may be able to determine the existence of a file outside the web server root by supplying passing various path values for INIFILE. A denial of service condition could be caused in the software by providing a device name such as CON, AUX, COM1, COM2 instead of a valid file name as one of the arguments for INIFILE. This may cause the service to crash or hang. A cross-site scripting vulnerability has also been reported to exist in the software due to insufficient santization of user-supplied input to INIFILE. This problem presents itself when an invalid file name is supplied as an argument for INIFILE. This vulnerability could be exploited to steal cookie-based credentials. Other attacks are possible as well. http://www.example.com/udataobj/webgui/cgi-bin/tuxadm.exe?INIFILE=<script>alert('XSS')</script>