Overview 237 matches · 5 in Waratek scope · 2 protected · 6 exploited · 1 CISA KEV · 20 public PoC · 8 EPSS ≥ 0.5
237matches
5in Waratek scope2.1%
2protected0.8%
6exploited2.5%
1CISA KEV0.4%
20public PoC8.4%
8EPSS ≥ 0.53.4%
Protected by Waratek
2
0.8%
Rule in development
0
0.0%
Mitigation candidate
1
0.4%
No exploit published
2
0.8%
Outside Waratek scope
8
3.4%
Not applicable
224
94.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
0.8%
partly blocked
0
0.0%
not blocked
235
99.2%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
6
2.5%
Working exploit published
17
7.2%
Proof of concept only
0
0.0%
Forecast only
3
1.3%
No public exploit
211
89.0%
split by
peak 60 / year
19991
Not applicable1
High1
not blocked1
No public exploit1
20000
20010
20020
20030
20040
20051
Not applicable1
Medium1
not blocked1
No public exploit1
20060
20071
Not applicable1
Medium1
not blocked1
No public exploit1
20080
20090
20101
Not applicable1
Low1
not blocked1
No public exploit1
20110
20120
20130
201416
Not applicable16
High2
Medium14
not blocked16
Exploited1
Working exploit published3
Forecast only1
No public exploit11
201560
Outside Waratek scope6
Not applicable54
High35
Medium23
Low2
not blocked60
Exploited2
Working exploit published9
No public exploit49
201658
Protected by Waratek1
No exploit published2
Not applicable55
Critical6
High32
Medium19
Low1
blocked by ARMR today1
not blocked57
Working exploit published2
Forecast only2
No public exploit54
201734
Mitigation candidate1
Not applicable33
Critical7
High13
Medium14
not blocked34
Exploited1
Working exploit published2
No public exploit31
201814
Protected by Waratek1
Outside Waratek scope1
Not applicable12
Critical2
High9
Medium3
blocked by ARMR today1
not blocked13
No public exploit14
201941
Outside Waratek scope1
Not applicable40
Critical5
High25
Medium11
not blocked41
Exploited2
Working exploit published1
No public exploit38
20203
Not applicable3
High2
Medium1
not blocked3
No public exploit3
20211
Not applicable1
Medium1
not blocked1
No public exploit1
20220
20231
Not applicable1
High1
not blocked1
No public exploit1
20240
20251
Not applicable1
High1
not blocked1
No public exploit1
20264
Not applicable4
High2
Medium2
not blocked4
No public exploit4
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2015-0819 | Medium | 2015-02-25 | Not applicable | No public exploit | The UITour::onPageEvent function in Mozilla Firefox before 36.0 does not ensure that an API call originates from a foreground tab, which allows remote attackers to conduct spoofing and clickjacking attacks by leveraging access to a UI Tour web site. |
| CVE-2015-0618 | High | 2015-02-21 | Not applicable | No public exploit | Cisco IOS XR 5.0.1 and 5.2.1 on Network Convergence System (NCS) 6000 devices and 5.1.3 and 5.1.4 on Carrier Routing System X (CRS-X) devices allows remote attackers to cause a denial of service (line-card reload) via malformed IPv6 packets with extension headers, aka Bug ID CSCuq95241. |
| CVE-2015-0621 | High | 2015-02-18 | Not applicable | No public exploit | Cisco TelePresence MCU devices with software 4.5(1.45) allow remote attackers to cause a denial of service (device reload) via an unspecified series of TCP packets, aka Bug ID CSCur50347. |
| CVE-2014-0227 | Medium | 2015-02-16 | Outside Waratek scope | No public exploit | java/org/apache/coyote/http11/filters/ChunkedInputFilter.java in Apache Tomcat 6.x before 6.0.42, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle attempts to continue reading data after an error has occurred, which allows remote attackers to conduct HTTP request smuggling attacks or cause a denial of service (resource consumption) by streaming data with malformed chunked transfer coding. |
| CVE-2015-1574 | Medium | 2015-02-15 | Not applicable | No public exploit | The Google Email application 4.2.2.0200 for Android allows remote attackers to cause a denial of service (persistent application crash) via a "Content-Disposition: ;" header in an e-mail message. |
| CVE-2015-0060 | Medium | 2015-02-11 | Not applicable | Working exploit published | The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly scale fonts, which allows local users to cause a denial of service (system hang) via a crafted application, aka "Windows Font Driver Denial of Service Vulnerability." |
| CVE-2014-8835 | High | 2015-01-30 | Not applicable | Working exploit published | The xpc_data_get_bytes function in libxpc in Apple OS X before 10.10.2 does not verify that a dictionary's Attributes key has the xpc_data data type, which allows attackers to execute arbitrary code by providing a crafted dictionary to sysmond, related to an "XPC type confusion" issue. |
| CVE-2014-8826 | Medium | 2015-01-30 | Not applicable | Working exploit published | LaunchServices in Apple OS X before 10.10.2 does not properly handle file-type metadata, which allows attackers to bypass the Gatekeeper protection mechanism via a crafted JAR archive. |
| CVE-2014-8822 | High | 2015-01-30 | Not applicable | No public exploit | IOHIDFamily in Apple OS X before 10.10.2 allows attackers to execute arbitrary code in a kernel context or cause a denial of service (write to kernel memory) via a crafted app that calls an unspecified user-client method. |
| CVE-2014-8817 | High | 2015-01-30 | Not applicable | No public exploit | coresymbolicationd in CoreSymbolication in Apple OS X before 10.10.2 does not verify that expected data types are present in XPC messages, which allows attackers to execute arbitrary code in a privileged context via a crafted app, as demonstrated by lack of verification of xpc_dictionary_get_value API return values during handling of a (1) match_mmap_archives, (2) delete_mmap_archives, (3) write_mmap_archive, or (4) read_mmap_archive command. |
| CVE-2014-4492 | High | 2015-01-30 | Not applicable | Working exploit published | libnetcore in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not verify that certain values have the expected data type, which allows attackers to execute arbitrary code in an _networkd context via a crafted XPC message from a sandboxed app, as demonstrated by lack of verification of the XPC dictionary data type. |
| CVE-2014-4488 | High | 2015-01-30 | Not applicable | No public exploit | IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly validate resource-queue metadata, which allows attackers to execute arbitrary code in a privileged context via a crafted app. |
| CVE-2014-4484 | High | 2015-01-30 | Not applicable | No public exploit | FontParser in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .dfont file. |
| CVE-2014-7928 | High | 2015-01-22 | Not applicable | No public exploit | hydrogen.cc in Google V8, as used Google Chrome before 40.0.2214.91, does not properly handle arrays with holes, which allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via crafted JavaScript code that triggers an array copy. |
| CVE-2014-9194 | High | 2015-01-17 | Not applicable | No public exploit | Arbiter 1094B GPS Substation Clock allows remote attackers to cause a denial of service (disruption) via crafted radio transmissions that spoof GPS satellite broadcasts. |
| CVE-2015-0560 | Medium | 2015-01-10 | Not applicable | No public exploit | The dissect_wccp2r1_address_table_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.10.x before 1.10.12 and 1.12.x before 1.12.3 does not initialize certain data structures, which allows remote attackers to cause a denial of service (application crash) via a crafted packet. |
| CVE-2014-9221 | Medium | 2015-01-07 | Not applicable | No public exploit | strongSwan 4.5.x through 5.2.x before 5.2.1 allows remote attackers to cause a denial of service (invalid pointer dereference) via a crafted IKEv2 Key Exchange (KE) message with Diffie-Hellman (DH) group 1025. |
| CVE-2013-4769 | Medium | 2014-12-26 | Not applicable | No public exploit | The cloud controller (aka CLC) component in Eucalyptus 3.3.x and 3.4.x before 3.4.2, when the dns.recursive.enabled setting is used, allows remote attackers to cause a denial of service (traffic amplification) via spoofed DNS queries. |
| CVE-2014-8014 | Medium | 2014-12-18 | Not applicable | No public exploit | Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCub63710. |
| CVE-2014-6089 | Medium | 2014-12-18 | Not applicable | No public exploit | IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote authenticated users to cause a denial of service (disrupted system operations) by uploading a file to a protected area. |
| CVE-2014-6053 | Medium | 2014-12-15 | Not applicable | No public exploit | The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a large amount of ClientCutText data, which allows remote attackers to cause a denial of service (memory consumption or daemon crash) via a crafted message that is processed by using a single unchecked malloc. |
| CVE-2014-8298 | High | 2014-12-10 | Not applicable | No public exploit | The NVIDIA Linux Discrete GPU drivers before R304.125, R331.x before R331.113, R340.x before R340.65, R343.x before R343.36, and R346.x before R346.22, Linux for Tegra (L4T) driver before R21.2, and Chrome OS driver before R40 allows remote attackers to cause a denial of service (segmentation fault and X server crash) or possibly execute arbitrary code via a crafted GLX indirect rendering protocol request. |
| CVE-2014-9350 | Medium | 2014-12-08 | Not applicable | Working exploit published | TP-Link TL-WR740N 4 with firmware 3.17.0 Build 140520, 3.16.6 Build 130529, and 3.16.4 Build 130205 allows remote attackers to cause a denial of service (httpd crash) via vectors involving a "new" value in the isNew parameter to PingIframeRpm.htm. |
| CVE-2014-7247 | High | 2014-11-26 | Not applicable | Exploited | Unspecified vulnerability in JustSystems Ichitaro 2008 through 2011; Ichitaro Government 6, 7, 2008, 2009, and 2010; Ichitaro Pro; Ichitaro Pro 2; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen; and Ichitaro 2014 Tetsu allows remote attackers to execute arbitrary code via a crafted file. |
| CVE-2014-7141 | Medium | 2014-11-26 | Not applicable | Forecast only | The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet. |
| CVE-2014-6610 | Medium | 2014-11-26 | Not applicable | No public exploit | Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dialplan application. |
| CVE-2014-9034 | Medium | 2014-11-25 | Not applicable | Working exploit published | wp-includes/class-phpass.php in WordPress before 3.7.5, 3.8.x before 3.8.5, 3.9.x before 3.9.3, and 4.x before 4.0.1 allows remote attackers to cause a denial of service (CPU consumption) via a long password that is improperly handled during hashing, a similar issue to CVE-2014-9016. |
| CVE-2014-8598 | Medium | 2014-11-18 | Not applicable | Working exploit published | The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows remote attackers to (1) upload arbitrary XML files via the import page or (2) obtain sensitive information via the export page. NOTE: this issue can be combined with CVE-2014-7146 to execute arbitrary PHP code. |
| CVE-2014-3629 | Medium | 2014-11-17 | Not applicable | No public exploit | XML external entity (XXE) vulnerability in the XML Exchange module in Apache Qpid 0.30 allows remote attackers to cause outgoing HTTP connections via a crafted message. |
| CVE-2014-3916 | Medium | 2014-11-16 | Not applicable | No public exploit | The str_buf_cat function in string.c in Ruby 1.9.3, 2.0.0, and 2.1 allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string. |
| CVE-2014-3756 | Medium | 2014-11-16 | Not applicable | No public exploit | The client in Mumble 1.2.x before 1.2.6 allows remote attackers to force the loading of an external file and cause a denial of service (hang and resource consumption) via a crafted string that is treated as rich-text by a Qt widget, as demonstrated by the (1) user or (2) channel name in a Qt dialog, (3) subject common name or (4) email address to the Certificate Wizard, or (5) server name in a tooltip. |
| CVE-2014-2682 | Medium | 2014-11-16 | Not applicable | No public exploit | Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0, when PHP-FPM is used, does not properly share the libxml_disable_entity_loader setting between threads, which might allow remote attackers to conduct XML External Entity (XXE) attacks via an XML external entity declaration in conjunction with an entity reference. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657. |
| CVE-2014-2681 | Medium | 2014-11-16 | Not applicable | No public exploit | Zend Framework 1 (ZF1) before 1.12.4, Zend Framework 2 before 2.1.6 and 2.2.x before 2.2.6, ZendOpenId, ZendRest, ZendService_AudioScrobbler, ZendService_Nirvanix, ZendService_SlideShare, ZendService_Technorati, and ZendService_WindowsAzure before 2.0.2, ZendService_Amazon before 2.0.3, and ZendService_Api before 1.0.0 allow remote attackers to read arbitrary files, send HTTP requests to intranet servers, and possibly cause a denial of service (CPU and memory consumption) via an XML External Entity (XXE) attack. NOTE: this issue exists because of an incomplete fix for CVE-2012-5657. |
| CVE-2010-0213 | Low | 2010-07-28 | Not applicable | No public exploit | BIND 9.7.1 and 9.7.1-P1, when a recursive validating server has a trust anchor that is configured statically or via DNSSEC Lookaside Validation (DLV), allows remote attackers to cause a denial of service (infinite loop) via a query for an RRSIG record whose answer is not in the cache, which causes BIND to repeatedly send RRSIG queries to the authoritative servers. |
| CVE-2007-0494 | Medium | 2007-01-25 | Not applicable | No public exploit | ISC BIND 9.0.x, 9.1.x, 9.2.0 up to 9.2.7, 9.3.0 up to 9.3.3, 9.4.0a1 up to 9.4.0a6, 9.4.0b1 up to 9.4.0b4, 9.4.0rc1, and 9.5.0a1 (Bind Forum only) allows remote attackers to cause a denial of service (exit) via a type * (ANY) DNS query response that contains multiple RRsets, which triggers an assertion error, aka the "DNSSEC Validation" vulnerability. |
| CVE-2005-4856 | Medium | 2005-12-31 | Not applicable | No public exploit | The admin interface in eZ publish 3.5 before 3.5.7, 3.6 before 3.6.5, 3.7 before 3.7.3, and 3.8 before 20051110 does not properly handle authorization errors, which allows remote attackers to obtain sensitive information and see the admin pagelayout and associated templates via a request with (1) "anything after the url" or (2) a "wrong url". |
| CVE-1999-0226 | High | 1999-01-01 | Not applicable | No public exploit | Windows NT TCP/IP processes fragmented IP packets improperly, causing a denial of service. |