WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕ARMR rules: XXE✕
Overview 5 matches · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
5matches 0exploited0.0% 0CISA KEV0.0% 3EPSS ≥ 0.560.0%
Protected by Waratek 5 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 1 20.0% High 0 0.0% Medium 4 80.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 5 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / quarter
Protected by Waratek: 5 Medium: 4Critical: 1 blocked by ARMR today: 5 Working exploit published: 5
Q2 141 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Q3 140 Q4 140 Q1 150 Q2 151 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Q3 150 Q4 150 Q1 160 Q2 160 Q3 160 Q4 160 Q1 170 Q2 171 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Q3 170 Q4 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 Q1 180 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 191 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1
Q3 14Q1 15Q3 15Q1 16Q3 16Q1 17Q3 17Q1 18Q3 18Q1 19Q3 19
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-2861 Medium 2019-07-23 Protected by Waratek Working exploit published Vulnerability in the Oracle Hyperion Planning component of Oracle Hyperion (subcomponent: Security). The supported version that is affected is 11.1.2.4. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Planning. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Planning accessible data. CVSS 3.0 Base Score 4.2 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N).
CVE-2017-12629 Critical 2017-10-14 Protected by Waratek Working exploit published Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
CVE-2017-3548 Medium 2017-04-24 Protected by Waratek Working exploit published Vulnerability in the PeopleSoft Enterprise PeopleTools component of Oracle PeopleSoft Products (subcomponent: Integration Broker). Supported versions that are affected are 8.54 and 8.55. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.0 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L).
CVE-2015-1833 Medium 2015-05-29 Protected by Waratek Working exploit published XML external entity (XXE) vulnerability in Apache Jackrabbit before 2.0.6, 2.2.x before 2.2.14, 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.1, and 2.10.x before 2.10.1 allows remote attackers to read arbitrary files and send requests to intranet servers via a crafted WebDAV request.
CVE-2014-3004 Medium 2014-06-11 Protected by Waratek Working exploit published The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.