VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 19 hours ago
Reset
More filters (1)
Columns
Published to 2016-12-31✕
Overview 7 matches, all in RASP scope, all public PoC · 5 protected · 0 KEV · 0 CISA SSVC · 1 EPSS ≥ 0.5 · 0 disputed
7matches, all in RASP scope, all public PoC 5protected71.4% 0KEV0.0% 0CISA SSVC0.0% 1EPSS ≥ 0.514.3% 0disputed0.0%
Critical 2 28.6% High 3 42.9% Medium 2 28.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 4 57.1% Rule in development 0 0.0% Mitigation candidate 1 14.3% No exploit published 0 0.0% No fix identified 1 14.3% Mitigated by environment configuration 1 14.3% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 5 71.4% not blocked 2 28.6% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 0 0.0% Working exploit published 0 0.0% Proof of concept only 7 100.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / quarter
Unknown: 0None: 0Low: 0Medium: 2High: 3Critical: 2 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 1No fix identified: 1No exploit published: 0Mitigation candidate: 1Rule in development: 0Protected by RASP: 4 unrecorded: 0not established: 0not blocked: 2blocked by ARMR today: 5 No public exploit: 0Forecast only: 0Proof of concept only: 7Working exploit published: 0Exploited in the wild: 0 Q4 2011: 1 CVE Q1 2012: 0 CVEs Q2 2012: 0 CVEs Q3 2012: 0 CVEs Q4 2012: 0 CVEs Q1 2013: 1 CVE Q2 2013: 0 CVEs Q3 2013: 0 CVEs Q4 2013: 1 CVE Q1 2014: 0 CVEs Q2 2014: 0 CVEs Q3 2014: 0 CVEs Q4 2014: 1 CVE Q1 2015: 1 CVE Q2 2015: 0 CVEs Q3 2015: 0 CVEs Q4 2015: 0 CVEs Q1 2016: 1 CVE Q2 2016: 1 CVE
Q4 11Q2 12Q4 12Q2 13Q4 13Q2 14Q4 14Q2 15Q4 15Q2 16
7 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2016-0638 Critical 2016-04-21 Protected by RASP Proof of concept only Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.
CVE-2015-5254 Critical 2016-01-08 Protected by RASP Proof of concept only Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
CVE-2014-6598 High 2015-01-21 No fix identified Proof of concept only Unspecified vulnerability in the Oracle Communications Diameter Signaling Router component in Oracle Communications Applications 3.x, 4.x, and 5.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Signaling - DPI.
CVE-2014-3625 Medium 2014-11-20 Protected by RASP Proof of concept only Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.
CVE-2013-2186 High 2013-10-28 Protected by RASP Proof of concept only The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.
CVE-2013-1491 High 2013-03-08 Mitigated by environment configuration Proof of concept only The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, 6 Update 43 and earlier, 5.0 Update 41 and earlier, and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D, as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.
CVE-2011-2894 Medium 2011-10-04 Mitigation candidate Proof of concept only Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.