WaratekVRT Sign in
Reset
More filters (2)
Columns
ARMR rules: Deserialization✕Published to 2016-08-31✕
Overview 19 matches · 18 protected · 5 exploited · 3 CISA KEV · 7 public PoC · 6 EPSS ≥ 0.5
19matches 18protected94.7% 5exploited26.3% 3CISA KEV15.8% 7public PoC36.8% 6EPSS ≥ 0.531.6%
Protected by Waratek 19 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 9 47.4% High 8 42.1% Medium 2 10.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 18 94.7% partly blocked 1 5.3% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 5 26.3% Working exploit published 2 10.5% Proof of concept only 2 10.5% Forecast only 0 0.0% No public exploit 10 52.6%
split by peak 9 / year
Protected by Waratek: 19 Medium: 2High: 8Critical: 9 partly blocked: 1blocked by ARMR today: 18 No public exploit: 10Proof of concept only: 2Working exploit published: 2Exploited: 5
20051 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20060 20070 20080 20091 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20100 20111 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1 20120 20132 Protected by Waratek2 High2 blocked by ARMR today2 Exploited1 No public exploit1 20142 Protected by Waratek2 High2 blocked by ARMR today2 No public exploit2 20153 Protected by Waratek3 Critical2 High1 blocked by ARMR today3 Exploited1 Working exploit published1 No public exploit1 20169 Protected by Waratek9 Critical7 High2 blocked by ARMR today8 partly blocked1 Exploited3 Working exploit published1 Proof of concept only1 No public exploit4
200520062007200820092010201120122013201420152016
19 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2016-3737 Critical 2016-08-02 Protected by Waratek No public exploit The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.
CVE-2016-3510 Critical 2016-07-21 Protected by Waratek Working exploit published Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability than CVE-2016-3586.
CVE-2016-4974 High 2016-07-13 Protected by Waratek No public exploit Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath, which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.
CVE-2016-4437 Critical 2016-06-07 Protected by Waratek Exploited Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
CVE-2016-0376 High 2016-06-03 Protected by Waratek No public exploit The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1 before SR3 FP40 (7.1.3.40), and 8 before SR3 (8.0.3.0) does not properly deserialize classes in an AccessController doPrivileged block, which allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code as demonstrated by the readValue method of the com.ibm.rmi.io.ValueHandlerPool.ValueHandlerSingleton class, which implements the javax.rmi.CORBA.ValueHandler interface. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-5456.
CVE-2016-3427 Critical 2016-04-21 Protected by Waratek Exploited Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2016-0638 Critical 2016-04-21 Protected by Waratek Exploited Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6, 12.1.2, 12.1.3, and 12.2.1 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Messaging Service.
CVE-2016-0788 Critical 2016-04-07 Protected by Waratek No public exploit The remoting module in Jenkins before 1.650 and LTS before 1.642.2 allows remote attackers to execute arbitrary code by opening a JRMP listener.
CVE-2015-5254 Critical 2016-01-08 Protected by Waratek Proof of concept only Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
CVE-2015-8103 Critical 2015-11-25 Protected by Waratek Working exploit published The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".
CVE-2015-4852 Critical 2015-11-18 Protected by Waratek Exploited The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a crafted serialized Java object in T3 protocol traffic to TCP port 7001, related to oracle_common/modules/com.bea.core.apache.commons.collections.jar. NOTE: the scope of this CVE is limited to the WebLogic Server product.
CVE-2014-1972 High 2015-08-22 Protected by Waratek No public exploit Apache Tapestry before 5.3.6 relies on client-side object storage without checking whether a client has modified an object, which allows remote attackers to cause a denial of service (resource consumption) or execute arbitrary code via crafted serialized data.
CVE-2014-0003 High 2014-03-21 Protected by Waratek No public exploit The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.
CVE-2013-2185 High 2014-01-19 Protected by Waratek No public exploit The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue
CVE-2013-4271 High 2013-10-10 Protected by Waratek No public exploit The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources, which allows remote attackers to execute arbitrary Java code via a serialized object, a different vulnerability than CVE-2013-4221.
CVE-2013-2165 High 2013-07-23 Protected by Waratek Exploited ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.
CVE-2011-2894 Medium 2011-10-04 Protected by Waratek Proof of concept only Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
CVE-2009-2723 High 2009-08-10 Protected by Waratek No public exploit Unspecified vulnerability in deserialization in the Provider class in Sun Java SE 5.0 before Update 20 has unknown impact and attack vectors, aka BugId 6444262.
CVE-2005-0223 Medium 2005-05-02 Protected by Waratek No public exploit The Software Development Kit (SDK) and Run Time Environment (RTE) 1.4.1 and 1.4.2 for Tru64 UNIX allows remote attackers to cause a denial of service (Java Virtual Machine hang) via object deserialization.