VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 18 hours ago
Reset
More filters (3)
Columns
Protection: none✕Published from 2017-09-01✕Published to 2017-09-30✕
Overview 24 matches, all in RASP scope · 0 protected · 0 KEV · 1 public PoC · 0 CISA SSVC · 1 EPSS ≥ 0.5 · 0 disputed
24matches, all in RASP scope 0protected0.0% 0KEV0.0% 1public PoC4.2% 0CISA SSVC0.0% 1EPSS ≥ 0.54.2% 0disputed0.0%
Critical 1 4.2% High 12 50.0% Medium 11 45.8% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 22 91.7% No fix identified 2 8.3% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 0 0.0% not blocked 24 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 4.2% No public exploit 23 95.8%
split by peak 24 / month
Unknown: 0None: 0Low: 0Medium: 11High: 12Critical: 1 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 2No exploit published: 22Mitigation candidate: 0Rule in development: 0Protected by RASP: 0 unrecorded: 0not established: 0not blocked: 24blocked by ARMR today: 0 No public exploit: 23Forecast only: 1Proof of concept only: 0Working exploit published: 0Exploited in the wild: 0 September 2017: 24 CVEs
Sep 17
24 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2017-9794 Medium 2017-09-30 No exploit published No public exploit When a cluster is operating in secure mode, a user with read privileges for specific data regions can use the gfsh command line utility to execute queries. In Apache Geode before 1.2.1, the query results may contain data from another user's concurrently executing gfsh query, potentially revealing data that the user is not authorized to view.
CVE-2017-9790 High 2017-09-29 No exploit published No public exploit When handling a libprocess message wrapped in an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev crashes if the request path is empty, because the parser assumes the request path always starts with '/'. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
CVE-2017-7687 High 2017-09-29 No exploit published No public exploit When handling a decoding failure for a malformed URL path of an HTTP request, libprocess in Apache Mesos before 1.1.3, 1.2.x before 1.2.2, 1.3.x before 1.3.1, and 1.4.0-dev might crash because the code accidentally calls inappropriate function. A malicious actor can therefore cause a denial of service of Mesos masters rendering the Mesos-controlled cluster inoperable.
CVE-2015-6748 Medium 2017-09-25 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in jsoup before 1.8.3.
CVE-2015-5184 High 2017-09-25 No exploit published No public exploit Console: CORS headers set to allow all in Red Hat AMQ.
CVE-2015-5183 High 2017-09-25 No exploit published No public exploit Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
CVE-2015-5181 Medium 2017-09-25 No exploit published No public exploit The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
CVE-2015-5169 Medium 2017-09-25 No exploit published No public exploit Cross-site scripting (XSS) vulnerability in Apache Struts before 2.3.20.
CVE-2017-9804 High 2017-09-20 No exploit published No public exploit In Apache Struts 2.3.7 through 2.3.33 and 2.5 through 2.5.12, if an application allows entering a URL in a form field and built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL. NOTE: this vulnerability exists because of an incomplete fix for S2-047 / CVE-2017-7672.
CVE-2017-9793 High 2017-09-20 No exploit published No public exploit The REST Plugin in Apache Struts 2.1.x, 2.3.7 through 2.3.33 and 2.5 through 2.5.12 is using an outdated XStream library which is vulnerable and allow perform a DoS attack using malicious request with specially crafted XML payload.
CVE-2016-8738 Medium 2017-09-20 No exploit published No public exploit In Apache Struts 2.5 through 2.5.5, if an application allows entering a URL in a form field and the built-in URLValidator is used, it is possible to prepare a special URL which will be used to overload server process when performing validation of the URL.
CVE-2017-12616 High 2017-09-19 No exploit published Forecast only When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was possible to bypass security constraints and/or view the source code of JSPs for resources served by the VirtualDirContext using a specially crafted request.
CVE-2015-1849 Medium 2017-09-19 No exploit published No public exploit AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled.
CVE-2017-9803 High 2017-09-18 No exploit published No public exploit Apache Solr's Kerberos plugin can be configured to use delegation tokens, which allows an application to reuse the authentication of an end-user or another application. There are two issues with this functionality (when using SecurityAwareZkACLProvider type of ACL provider e.g. SaslZkACLProvider). Firstly, access to the security configuration can be leaked to users other than the solr super user. Secondly, malicious users can exploit this leaked configuration for privilege escalation to further expose/modify private data and/or disrupt operations in the Solr cluster. The vulnerability is fixed from Apache Solr 6.6.1 onwards.
CVE-2015-0110 Medium 2017-09-15 No fix identified No public exploit IBM Business Process Manager (aka BPM) 7.5.x, 8.0.x, and 8.5.x and WebSphere Lombardi Edition (aka WLE) 7.2.x allow remote authenticated users to bypass intended access restrictions on internal service types via vectors involving the executeServiceByName URL.
CVE-2014-7808 High 2017-09-15 No exploit published No public exploit Apache Wicket before 1.5.13, 6.x before 6.19.0, and 7.x before 7.0.0-M5 make it easier for attackers to defeat a cryptographic protection mechanism and predict encrypted URLs by leveraging use of CryptoMapper as the default encryption provider.
CVE-2017-7561 High 2017-09-13 No exploit published No public exploit Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.
CVE-2017-3165 Medium 2017-09-13 No exploit published No public exploit In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site scripting where one authenticated user can cause scripts to run in the browser of another user authorized to access the first user's resources. This is due to improper escaping of server-side content. There is known to be a proof-of-concept exploit using this vulnerability.
CVE-2016-8737 High 2017-09-13 No exploit published No public exploit In Apache Brooklyn before 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could permit a malicious web site to produce a link which, if clicked whilst a user is logged in to Brooklyn, would cause the server to execute the attacker's commands as the user. There is known to be a proof-of-concept exploit using this vulnerability.
CVE-2014-9635 Medium 2017-09-12 No exploit published No public exploit Jenkins before 1.586 does not set the HttpOnly flag in a Set-Cookie header for session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.
CVE-2014-9634 Medium 2017-09-12 No exploit published No public exploit Jenkins before 1.586 does not set the secure flag on session cookies when run on Tomcat 7.0.41 or later, which makes it easier for remote attackers to capture cookies by intercepting their transmission within an HTTP session.
CVE-2015-3250 High 2017-09-07 No exploit published No public exploit Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
CVE-2017-14159 Medium 2017-09-05 No fix identified No public exploit slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript.
CVE-2016-3086 Critical 2017-09-05 No exploit published No public exploit The YARN NodeManager in Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for credential store provider used by the NodeManager to YARN Applications.