WaratekVRT Sign in
Reset
More filters (2)
Columns
ARMR rules: Deserialization✕Has a public PoC✕
Overview 2 matches · 0 exploited · 0 CISA KEV · 0 EPSS ≥ 0.5
2matches 0exploited0.0% 0CISA KEV0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 2 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 2 100.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / year
Protected by Waratek: 2 Medium: 2 blocked by ARMR today: 2 Proof of concept only: 2
20111 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1 20120 20130 20140 20150 20160 20170 20180 20190 20200 20210 20220 20231 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1
2011201320152017201920212023
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-34050 Medium 2023-10-19 Protected by Waratek Proof of concept only In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no allowed list was provided, all classes could be deserialized. Specifically, an application is vulnerable if * the SimpleMessageConverter or SerializerMessageConverter is used * the user does not configure allowed list patterns * untrusted message originators gain permissions to write messages to the RabbitMQ broker to send malicious content
CVE-2011-2894 Medium 2011-10-04 Protected by Waratek Proof of concept only Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.