WaratekVRT Sign in

CWE-22 CVEs with no public exploit

2 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-22✕
Overview 2 matches · 0 exploited · 0 CISA KEV · 0 public PoC
2matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 1 50.0% High 0 0.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 2 100.0% No public exploit 0 0.0%
split by peak 1 / month
Protected by Waratek: 2 Medium: 1Critical: 1 blocked by ARMR today: 2 Forecast only: 2
May 231 Protected by Waratek1 Medium1 blocked by ARMR today1 Forecast only1 Jun 230 Jul 230 Aug 230 Sep 230 Oct 230 Nov 230 Dec 230 Jan 240 Feb 240 Mar 241 Protected by Waratek1 Critical1 blocked by ARMR today1 Forecast only1
May 23Jun 23Jul 23Aug 23Sep 23Oct 23Nov 23Dec 23Jan 24Feb 24Mar 24
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-27317 Critical 2024-03-12 Protected by Waratek Forecast only In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.
CVE-2023-32985 Medium 2023-05-16 Protected by Waratek Forecast only Jenkins Sidebar Link Plugin 2.2.1 and earlier does not restrict the path of files in a method implementing form validation, allowing attackers with Overall/Read permission to check for the existence of an attacker-specified file path on the Jenkins controller file system.