WaratekVRT Sign in
Reset
More filters (1)
Columns
Oracle product: Oracle Retail Applications / Foundation (Spring Framework)✕
Overview 3 matches · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
3matches 1exploited33.3% 1CISA KEV33.3% 1public PoC33.3% 1EPSS ≥ 0.533.3%
Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 1 33.3% High 1 33.3% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 33.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 66.7%
split by peak 1 / month
Protected by Waratek: 3 Medium: 1High: 1Critical: 1 blocked by ARMR today: 3 No public exploit: 2Exploited: 1
May 211 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Jun 210 Jul 210 Aug 210 Sep 210 Oct 210 Nov 210 Dec 210 Jan 220 Feb 220 Mar 220 Apr 221 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 May 221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
May 21Jul 21Sep 21Nov 21Jan 22Mar 22May 22
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-22971 Medium 2022-05-12 Protected by Waratek No public exploit In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
CVE-2022-22965 Critical 2022-04-01 Protected by Waratek Exploited A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2021-22118 High 2021-05-27 Protected by Waratek No public exploit In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.