VRT 391,810 CVEs tracked · 15,472 in RASP scope · data as of 49 minutes ago
Reset
More filters (3)
Columns
Published from 2020-04-01✕Published to 2020-04-30✕Has a public PoC✕
Overview 6 matches, all in RASP scope, all public PoC · 2 protected · 2 KEV · 2 CISA SSVC · 2 EPSS ≥ 0.5 · 0 disputed
6matches, all in RASP scope, all public PoC 2protected33.3% 2KEV33.3% 2CISA SSVC33.3% 2EPSS ≥ 0.533.3% 0disputed0.0%
Critical 3 50.0% High 2 33.3% Medium 1 16.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 2 33.3% Rule in development 0 0.0% Mitigation candidate 3 50.0% No exploit published 1 16.7% No fix identified 0 0.0% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 2 33.3% not blocked 4 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 2 33.3% Working exploit published 3 50.0% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 6 / month
Unknown: 0None: 0Low: 0Medium: 1High: 2Critical: 3 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 0No exploit published: 1Mitigation candidate: 3Rule in development: 0Protected by RASP: 2 unrecorded: 0not established: 0not blocked: 4blocked by ARMR today: 2 No public exploit: 0Forecast only: 0Proof of concept only: 1Working exploit published: 3Exploited in the wild: 2 April 2020: 6 CVEs
Apr 20
6 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2020-2883 Critical 2020-04-15 Protected by RASP Exploited in the wild Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2020-2733 Critical 2020-04-15 Mitigation candidate Working exploit published Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2020-1958 Medium 2020-04-01 No exploit published Proof of concept only When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid. They are still subject to role-based authorization checks, if configured. Callers of Druid APIs can also retrieve any LDAP attribute values of users that exist on the LDAP server, so long as that information is visible to the Druid server. This information disclosure does not require the caller itself to be a valid LDAP user.
CVE-2020-10204 High 2020-04-01 Mitigation candidate Working exploit published Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
CVE-2020-10199 High 2020-04-01 Mitigation candidate Exploited in the wild Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
CVE-2019-17564 Critical 2020-04-01 Protected by RASP Working exploit published Unsafe deserialization occurs within a Dubbo application which has HTTP remoting enabled. An attacker may submit a POST request with a Java object in it to completely compromise a Provider instance of Apache Dubbo, if this instance enables HTTP. This issue affected Apache Dubbo 2.7.0 to 2.7.4, 2.6.0 to 2.6.7, and all 2.5.x versions.