VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 20 hours ago
Reset
More filters (3)
Columns
EPSS ≥ 0.5✕Published from 2020-12-01✕Published to 2020-12-31✕
Overview 6 matches, all in RASP scope, all public PoC, all EPSS ≥ 0.5 · 4 protected · 1 KEV · 1 CISA SSVC · 0 disputed
6matches, all in RASP scope, all public PoC, all EPSS ≥ 0.5 4protected66.7% 1KEV16.7% 1CISA SSVC16.7% 0disputed0.0%
Critical 2 33.3% High 1 16.7% Medium 3 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 4 66.7% Rule in development 0 0.0% Mitigation candidate 2 33.3% No exploit published 0 0.0% No fix identified 0 0.0% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 4 66.7% not blocked 2 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 1 16.7% Working exploit published 4 66.7% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 6 / month
Unknown: 0None: 0Low: 0Medium: 3High: 1Critical: 2 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 0No exploit published: 0Mitigation candidate: 2Rule in development: 0Protected by RASP: 4 unrecorded: 0not established: 0not blocked: 2blocked by ARMR today: 4 No public exploit: 0Forecast only: 0Proof of concept only: 1Working exploit published: 4Exploited in the wild: 1 December 2020: 6 CVEs
Dec 20
6 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2020-35774 Medium 2020-12-29 Mitigation candidate Working exploit published server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
CVE-2020-35476 Critical 2020-12-16 Protected by RASP Working exploit published A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)
CVE-2020-26259 Medium 2020-12-16 Protected by RASP Proof of concept only XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. The vulnerability may allow a remote attacker to delete arbitrary know files on the host as log as the executing process has sufficient rights only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist running Java 15 or higher. No user is affected, who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
CVE-2020-26258 High 2020-12-16 Protected by RASP Working exploit published XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.15, a Server-Side Forgery Request vulnerability can be activated when unmarshalling. The vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.15. The reported vulnerability does not exist if running Java 15 or higher. No user is affected who followed the recommendation to setup XStream's Security Framework with a whitelist! Anyone relying on XStream's default blacklist can immediately switch to a whilelist for the allowed types to avoid the vulnerability. Users of XStream 1.4.14 or below who still want to use XStream default blacklist can use a workaround described in more detailed in the referenced advisories.
CVE-2020-10770 Medium 2020-12-15 Mitigation candidate Working exploit published A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.
CVE-2020-17530 Critical 2020-12-11 Protected by RASP Exploited in the wild Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.