WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Retail Applications / Xstore Office (Apache HTTP Server)✕
Overview 4 matches · 0 in Waratek scope · 0 protected · 3 exploited · 0 CISA KEV · 1 public PoC · 3 EPSS ≥ 0.5
4matches 0in Waratek scope0.0% 0protected0.0% 3exploited75.0% 0CISA KEV0.0% 1public PoC25.0% 3EPSS ≥ 0.575.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 2 50.0% Not applicable 2 50.0% Withdrawn CVE 0 0.0%
Critical 1 25.0% High 2 50.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 75.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 1 25.0%
split by peak 1 / quarter
Not applicable: 2Outside Waratek scope: 2 Medium: 1High: 2Critical: 1 not blocked: 4 No public exploit: 1Exploited: 3
Q3 171 Not applicable1 High1 not blocked1 Exploited1 Q4 170 Q1 180 Q2 180 Q3 181 Outside Waratek scope1 Medium1 not blocked1 Exploited1 Q4 180 Q1 191 Not applicable1 High1 not blocked1 Exploited1 Q2 190 Q3 191 Outside Waratek scope1 Critical1 not blocked1 No public exploit1
Q3 17Q4 17Q1 18Q2 18Q3 18Q4 18Q1 19Q2 19Q3 19
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-10082 Critical 2019-09-26 Outside Waratek scope No public exploit In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.
CVE-2019-0190 High 2019-01-30 Not applicable Exploited A bug exists in the way mod_ssl handled client renegotiations. A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service. This bug can be only triggered with Apache HTTP Server version 2.4.37 when using OpenSSL version 1.1.1 or later, due to an interaction in changes to handling of renegotiation attempts.
CVE-2018-11763 Medium 2018-09-25 Outside Waratek scope Exploited In Apache HTTP Server 2.4.17 to 2.4.34, by sending continuous, large SETTINGS frames a client can occupy a connection, server thread and CPU time without any connection timeout coming to effect. This affects only HTTP/2 connections. A possible mitigation is to not enable the h2 protocol.
CVE-2017-9798 High 2017-09-18 Not applicable Exploited Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.