VRT 391,810 CVEs tracked · 15,472 in RASP scope · data as of 47 minutes ago
Reset
More filters (2)
Columns
Published from 2020-05-01✕Published to 2020-05-31✕
Overview 9 matches, all in RASP scope · 4 protected · 0 KEV · 0 public PoC · 0 CISA SSVC · 0 EPSS ≥ 0.5 · 0 disputed
9matches, all in RASP scope 4protected44.4% 0KEV0.0% 0public PoC0.0% 0CISA SSVC0.0% 0EPSS ≥ 0.50.0% 0disputed0.0%
Critical 9 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
Protected by RASP 4 44.4% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 44.4% No fix identified 1 11.1% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 4 44.4% not blocked 5 55.6% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 9 100.0%
split by peak 9 / month
Unknown: 0None: 0Low: 0Medium: 0High: 0Critical: 9 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 1No exploit published: 4Mitigation candidate: 0Rule in development: 0Protected by RASP: 4 unrecorded: 0not established: 0not blocked: 5blocked by ARMR today: 4 No public exploit: 9Forecast only: 0Proof of concept only: 0Working exploit published: 0Exploited in the wild: 0 May 2020: 9 CVEs
May 20
9 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2018-21234 Critical 2020-05-21 Protected by RASP No public exploit Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when setClassMetadataName is set.
CVE-2020-9409 Critical 2020-05-20 No fix identified No public exploit The administrative UI component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server for AWS Marketplace, and TIBCO JasperReports Server for ActiveMatrix BPM contains a vulnerability that theoretically allows an unauthenticated attacker to obtain the permissions of a JasperReports Server "superuser" for the affected systems. The attacker can theoretically exploit the vulnerability consistently, remotely, and without authenticating. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 7.1.1 and below, TIBCO JasperReports Server for AWS Marketplace: versions 7.1.1 and below, and TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.1.1 and below.
CVE-2020-13226 Critical 2020-05-20 No exploit published No public exploit WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this node's entire intranet.
CVE-2020-11973 Critical 2020-05-14 Protected by RASP No public exploit Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
CVE-2020-11972 Critical 2020-05-14 Protected by RASP No public exploit Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
CVE-2020-11050 Critical 2020-05-07 No exploit published No public exploit In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0.
CVE-2020-1961 Critical 2020-05-04 No exploit published No public exploit Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15, 2.1.X releases prior to 2.1.6, enabling attackers to inject arbitrary JEXL expressions, leading to Remote Code Execution (RCE) was discovered.
CVE-2020-1959 Critical 2020-05-04 No exploit published No public exploit A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions, leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages, they support different types of interpolation, including Java EL expressions. Therefore, if an attacker can inject arbitrary data in the error message template being passed, they will be able to run arbitrary Java code.
CVE-2020-10683 Critical 2020-05-01 Protected by RASP No public exploit dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.