WaratekVRT Sign in
Reset
More filters (3)
Columns
ARMR rules: SQL injection✕Published from 2016-01-01✕Published to 2016-12-31✕
Overview 4 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
4matches 0exploited0.0% 0CISA KEV0.0% 1public PoC25.0% 1EPSS ≥ 0.525.0%
Protected by Waratek 4 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 1 25.0% High 2 50.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 25.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 1 / month
Protected by Waratek: 4 Medium: 1High: 2Critical: 1 blocked by ARMR today: 4 No public exploit: 3Working exploit published: 1
Apr 161 Protected by Waratek1 High1 blocked by ARMR today1 Working exploit published1 May 160 Jun 161 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Jul 160 Aug 161 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Sep 160 Oct 161 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
Apr 16May 16Jun 16Jul 16Aug 16Sep 16Oct 16
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2016-6652 Medium 2016-10-05 Protected by Waratek No public exploit SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.
CVE-2016-4999 Critical 2016-08-05 Protected by Waratek No public exploit SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.
CVE-2016-2174 High 2016-06-13 Protected by Waratek No public exploit SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
CVE-2016-0710 High 2016-04-11 Protected by Waratek Working exploit published Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.