WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle GraalVM / JavaScript (Node.js)✕
Overview 4 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 1 EPSS ≥ 0.5
4matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 1EPSS ≥ 0.525.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 3 75.0% Not applicable 1 25.0% Withdrawn CVE 0 0.0%
Critical 1 25.0% High 3 75.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 25.0% No public exploit 3 75.0%
split by peak 1 / month
Not applicable: 1Outside Waratek scope: 3 High: 3Critical: 1 not blocked: 4 No public exploit: 3Forecast only: 1
Aug 191 Outside Waratek scope1 High1 not blocked1 Forecast only1 Sep 190 Oct 190 Nov 190 Dec 191 Not applicable1 High1 not blocked1 No public exploit1 Jan 200 Feb 201 Outside Waratek scope1 Critical1 not blocked1 No public exploit1 Mar 200 Apr 200 May 200 Jun 201 Outside Waratek scope1 High1 not blocked1 No public exploit1
Aug 19Sep 19Oct 19Nov 19Dec 19Jan 20Feb 20Mar 20Apr 20May 20Jun 20
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-11080 High 2020-06-03 Outside Waratek scope No public exploit In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., > 32), then drop the connection.
CVE-2019-15606 Critical 2020-02-07 Outside Waratek scope No public exploit Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
CVE-2019-16776 High 2019-12-13 Not applicable No public exploit Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
CVE-2019-9511 High 2019-08-13 Outside Waratek scope Forecast only Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.