VRT 391,192 CVEs tracked · 15,442 in RASP scope · data as of 16 hours ago
Reset
More filters (1)
Columns
Record: disputed✕
Overview 6 matches, all in RASP scope, all protected, all disputed · 0 KEV · 0 public PoC · 3 CISA SSVC · 0 EPSS ≥ 0.5
6matches, all in RASP scope, all protected, all disputed 0KEV0.0% 0public PoC0.0% 3CISA SSVC50.0% 0EPSS ≥ 0.50.0%
Critical 4 66.7% High 1 16.7% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 1 16.7%
Protected by RASP 6 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% No fix identified 0 0.0% Mitigated by environment configuration 0 0.0% Queued for review 0 0.0% Not applicable 0 0.0% Out of RASP scope 0 0.0% Rejected 0 0.0%
blocked by ARMR today 6 100.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited in the wild 0 0.0% Working exploit published 0 0.0% Proof of concept only 3 50.0% Forecast only 0 0.0% No public exploit 3 50.0%
split by peak 2 / year
Unknown: 1None: 0Low: 0Medium: 0High: 1Critical: 4 Rejected: 0Out of RASP scope: 0Not applicable: 0Queued for review: 0Mitigated by environment configuration: 0No fix identified: 0No exploit published: 0Mitigation candidate: 0Rule in development: 0Protected by RASP: 6 unrecorded: 0not established: 0not blocked: 0blocked by ARMR today: 6 No public exploit: 3Forecast only: 0Proof of concept only: 3Working exploit published: 0Exploited in the wild: 0 2014: 1 CVE 2015: 0 CVEs 2016: 0 CVEs 2017: 0 CVEs 2018: 0 CVEs 2019: 1 CVE 2020: 0 CVEs 2021: 0 CVEs 2022: 1 CVE 2023: 1 CVE 2024: 2 CVEs
20142015201620172018201920202021202220232024
6 matches CSV JSON
CVE Severity Published▾ Status Exploitation Description
CVE-2024-49203 Unknown 2024-11-20 Protected by RASP Proof of concept only Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.
CVE-2024-28125 Critical 2024-03-18 Protected by RASP No public exploit FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. Note: A contributor of FitNesse has claimed that this is not a vulnerability but a product specification and this is currently under further investigation.
CVE-2023-25330 Critical 2023-04-05 Protected by RASP Proof of concept only A SQL injection vulnerability in Mybatis plus below 3.5.3.1 allows remote attackers to execute arbitrary SQL commands via the tenant ID valuer. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications that avoid SQL injection.
CVE-2022-40929 Critical 2022-09-28 Protected by RASP Proof of concept only XXL-JOB 2.2.0 has a Command execution vulnerability in background tasks. NOTE: this is disputed because the issues/4929 report is about an intended and supported use case (running arbitrary Bash scripts on behalf of users).
CVE-2019-9212 Critical 2019-02-27 Protected by RASP No public exploit SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.caucho.naming.QName and com.sun.org.apache.xpath.internal.objects.XString is mishandled, related to Resin Gadget. NOTE: The vendor doesn’t consider this issue a vulnerability because the blacklist is being misused. SOFA Hessian supports custom blacklist and a disclaimer was posted encouraging users to update the blacklist or to use the whitelist feature for their specific needs since the blacklist is not being actively updated
CVE-2013-2185 High 2014-01-19 Protected by RASP No public exploit The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue