WaratekVRT Sign in
Reset
More filters (1)
Columns
CWE CWE-20✕
Overview 18 matches · 0 protected · 0 exploited · 0 CISA KEV · 9 EPSS ≥ 0.5
18matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 9EPSS ≥ 0.550.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 18 100.0% No exploit published 0 0.0%
Critical 3 16.7% High 9 50.0% Medium 6 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 18 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 18 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Mitigation candidate: 18 Medium: 6High: 9Critical: 3 not blocked: 18 Working exploit published: 18
20071 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20080 20091 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20101 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20111 Mitigation candidate1 High1 not blocked1 Working exploit published1 20121 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20131 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20141 Mitigation candidate1 High1 not blocked1 Working exploit published1 20150 20163 Mitigation candidate3 Critical1 High2 not blocked3 Working exploit published3 20170 20183 Mitigation candidate3 High3 not blocked3 Working exploit published3 20190 20202 Mitigation candidate2 Critical1 High1 not blocked2 Working exploit published2 20210 20220 20231 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20241 Mitigation candidate1 High1 not blocked1 Working exploit published1 20250 20261 Mitigation candidate1 Critical1 not blocked1 Working exploit published1
2008201020122014201620182020202220242026
18 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-41042 Critical 2026-07-08 Mitigation candidate Working exploit published Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version 1.2.1, which fixes the issue. This issue only happens when using H2, and H2 is mainly used for testing and local development. Also, Gravitino is typically deployed in the internal environment, so the severity is low.
CVE-2024-30188 High 2024-08-12 Mitigation candidate Working exploit published File read and write vulnerability in Apache DolphinScheduler ,  authenticated users can illegally access additional resource files. This issue affects Apache DolphinScheduler: from 3.1.0 before 3.2.2. Users are recommended to upgrade to version 3.2.2, which fixes the issue.
CVE-2023-45648 Medium 2023-10-10 Mitigation candidate Working exploit published Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests leading to the possibility of request smuggling when behind a reverse proxy. Older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.0-M12 onwards, 10.1.14 onwards, 9.0.81 onwards or 8.5.94 onwards, which fix the issue.
CVE-2020-10204 High 2020-04-01 Mitigation candidate Working exploit published Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
CVE-2014-9390 Critical 2020-02-12 Mitigation candidate Working exploit published Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
CVE-2018-1999002 High 2018-07-23 Mitigation candidate Working exploit published A arbitrary file read vulnerability exists in Jenkins 2.132 and earlier, 2.121.1 and earlier in the Stapler web framework's org/kohsuke/stapler/Stapler.java that allows attackers to send crafted HTTP requests returning the contents of any file on the Jenkins master file system that the Jenkins master has access to.
CVE-2018-10054 High 2018-04-11 Mitigation candidate Working exploit published H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code execution because CREATE ALIAS can execute arbitrary Java code. NOTE: the vendor's position is "h2 is not designed to be run outside of a secure environment."
CVE-2018-1321 High 2018-03-20 Mitigation candidate Working exploit published An administrator with report and template entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can use XSL Transformations (XSLT) to perform malicious operations, including but not limited to file read, file write, and code execution.
CVE-2016-1240 High 2016-10-03 Mitigation candidate Working exploit published The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tomcat6 and libtomcat6-java packages before 6.0.35-1ubuntu3.8 on Ubuntu 12.04 LTS, the tomcat7 and libtomcat7-java packages before 7.0.52-1ubuntu0.7 on Ubuntu 14.04 LTS, and tomcat8 and libtomcat8-java packages before 8.0.32-1ubuntu1.2 on Ubuntu 16.04 LTS allows local users with access to the tomcat account to gain root privileges via a symlink attack on the Catalina log file, as demonstrated by /var/log/tomcat7/catalina.out.
CVE-2016-3087 Critical 2016-06-07 Mitigation candidate Working exploit published Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
CVE-2016-0792 High 2016-04-07 Mitigation candidate Working exploit published Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVE-2014-0050 High 2014-04-01 Mitigation candidate Working exploit published MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
CVE-2013-2248 Medium 2013-07-20 Mitigation candidate Working exploit published Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the (1) redirect: or (2) redirectAction: prefix.
CVE-2011-4858 Medium 2012-01-05 Mitigation candidate Working exploit published Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
CVE-2011-5034 High 2011-12-30 Mitigation candidate Working exploit published Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
CVE-2010-1587 Medium 2010-04-28 Mitigation candidate Working exploit published The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
CVE-2008-6504 Medium 2009-03-23 Mitigation candidate Working exploit published ParametersInterceptor in OpenSymphony XWork 2.0.x before 2.0.6 and 2.1.x before 2.1.2, as used in Apache Struts and other products, does not properly restrict # (pound sign) references to context objects, which allows remote attackers to execute Object-Graph Navigation Language (OGNL) statements and modify server-side context objects, as demonstrated by use of a \u0023 representation for the # character.
CVE-2007-4556 Medium 2007-08-28 Mitigation candidate Working exploit published Struts support in OpenSymphony XWork before 1.2.3, and 2.x before 2.0.4, as used in WebWork and Apache Struts, recursively evaluates all input as an Object-Graph Navigation Language (OGNL) expression when altSyntax is enabled, which allows remote attackers to cause a denial of service (infinite loop) or execute arbitrary code via form input beginning with a "%{" sequence and ending with a "}" character.