WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-16✕
Overview 3 matches · 1 in Waratek scope · 0 protected · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
3matches 1in Waratek scope33.3% 0protected0.0% 0CISA KEV0.0% 2public PoC66.7% 1EPSS ≥ 0.533.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 2 66.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 1 33.3% Medium 2 66.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / quarter
Not applicable: 2Mitigation candidate: 1 Medium: 2High: 1 not blocked: 3 Exploited: 3
Q3 061 Not applicable1 High1 not blocked1 Exploited1 Q4 060 Q1 070 Q2 070 Q3 070 Q4 070 Q1 080 Q2 080 Q3 080 Q4 080 Q1 090 Q2 090 Q3 091 Not applicable1 Medium1 not blocked1 Exploited1 Q4 090 Q1 100 Q2 100 Q3 101 Mitigation candidate1 Medium1 not blocked1 Exploited1
Q3 06Q1 07Q3 07Q1 08Q3 08Q1 09Q3 09Q1 10Q3 10
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2010-2493 Medium 2010-08-10 Mitigation candidate Exploited The default configuration of the deployment descriptor (aka web.xml) in picketlink-sts.war in (1) the security_saml quickstart, (2) the webservice_proxy_security quickstart, (3) the web-console application, (4) the http-invoker application, (5) the gpd-deployer application, (6) the jbpm-console application, (7) the contract application, and (8) the uddi-console application in JBoss Enterprise SOA Platform before 5.0.2 contains GET and POST http-method elements, which allows remote attackers to bypass intended access restrictions via a crafted HTTP request.
CVE-2009-0696 Medium 2009-07-29 Not applicable Exploited The dns_db_findrdataset function in db.c in named in ISC BIND 9.4 before 9.4.3-P3, 9.5 before 9.5.1-P3, and 9.6 before 9.6.1-P1, when configured as a master server, allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an ANY record in the prerequisite section of a crafted dynamic update message.
CVE-2006-3677 High 2006-07-27 Not applicable Exploited Mozilla Firefox 1.5 before 1.5.0.5 and SeaMonkey before 1.0.3 allows remote attackers to execute arbitrary code by changing certain properties of the window navigator object (window.navigator) that are accessed when Java starts up, which causes a crash that leads to code execution.