WaratekVRT Sign in
Reset
More filters (1)
Columns
Waratek rule: Security rule✕
Overview 11 matches · 10 protected · 1 CISA KEV · 8 public PoC · 4 EPSS ≥ 0.5
11matches 10protected90.9% 1CISA KEV9.1% 8public PoC72.7% 4EPSS ≥ 0.536.4%
Protected by Waratek 11 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 11 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 10 90.9% partly blocked 1 9.1% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 11 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Protected by Waratek: 11 Medium: 11 partly blocked: 1blocked by ARMR today: 10 Exploited: 11
20081 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20090 20101 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20110 20120 20132 Protected by Waratek2 Medium2 blocked by ARMR today2 Exploited2 20140 20151 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20161 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20170 20180 20193 Protected by Waratek3 Medium3 blocked by ARMR today2 partly blocked1 Exploited3 20200 20211 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20221 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1
20082010201220142016201820202022
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-34305 Medium 2022-06-23 Protected by Waratek Exploited In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
CVE-2021-34429 Medium 2021-07-15 Protected by Waratek Exploited For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
CVE-2019-17554 Medium 2019-12-04 Protected by Waratek Exploited The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.
CVE-2019-18393 Medium 2019-10-24 Protected by Waratek Exploited PluginServlet.java in Ignite Realtime Openfire through 4.4.2 does not ensure that retrieved files are located under the Openfire home directory, aka a directory traversal vulnerability.
CVE-2019-2618 Medium 2019-04-23 Protected by Waratek Exploited Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: WLS Core Components). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data as well as unauthorized update, insert or delete access to some of Oracle WebLogic Server accessible data. CVSS 3.0 Base Score 5.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N).
CVE-2016-0457 Medium 2016-01-21 Protected by Waratek Exploited Unspecified vulnerability in the Application Mgmt Pack for E-Business Suite component in Oracle E-Business Suite 12.1 and 12.2 allows remote attackers to affect confidentiality via vectors related to REST Framework, a different vulnerability than CVE-2016-0456. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this issue is an XML External Entity (XXE) vulnerability, which allows remote attackers to read arbitrary files, cause a denial of service, conduct server-side request forgery (SSRF) attacks, or conduct SMB Relay attacks via a crafted DTD in an XML request to OA_HTML/lcmServiceController.jsp.
CVE-2015-5531 Medium 2015-08-17 Protected by Waratek Exploited Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls.
CVE-2013-6397 Medium 2013-12-07 Protected by Waratek Exploited Directory traversal vulnerability in SolrResourceLoader in Apache Solr before 4.6 allows remote attackers to read arbitrary files via a .. (dot dot) or full pathname in the tr parameter to solr/select/, when the response writer (wt parameter) is set to XSLT. NOTE: this can be leveraged using a separate XXE (XML eXternal Entity) vulnerability to allow access to files across restricted network boundaries.
CVE-2013-3827 Medium 2013-10-16 Protected by Waratek Exploited Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Fusion Middleware 2.1.1, 3.0.1, and 3.1.2; the Oracle JDeveloper component in Oracle Fusion Middleware 11.1.2.3.0, 11.1.2.4.0, and 12.1.2.0.0; and the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0 and 12.1.1 allows remote attackers to affect confidentiality via unknown vectors related to Java Server Faces or Web Container.
CVE-2010-0738 Medium 2010-04-28 Protected by Waratek Exploited The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVE-2007-6672 Medium 2008-01-08 Protected by Waratek Exploited Mortbay Jetty 6.1.5 and 6.1.6 allows remote attackers to bypass protection mechanisms and read the source of files via multiple '/' (slash) characters in the URI.