WaratekVRT Sign in

CWE-22 CVEs with a working exploit

30 CVEs, 29 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-22✕
Overview 30 matches · 29 protected · 0 exploited · 0 CISA KEV · 10 EPSS ≥ 0.5
30matches 29protected96.7% 0exploited0.0% 0CISA KEV0.0% 10EPSS ≥ 0.533.3%
Protected by Waratek 29 96.7% Rule in development 0 0.0% Mitigation candidate 1 3.3% No exploit published 0 0.0%
Critical 0 0.0% High 7 23.3% Medium 22 73.3% Low 1 3.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 29 96.7% partly blocked 0 0.0% not blocked 1 3.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 30 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Mitigation candidate: 1Protected by Waratek: 29 Low: 1Medium: 22High: 7 not blocked: 1blocked by ARMR today: 29 Working exploit published: 30
20031 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20040 20050 20061 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20071 Protected by Waratek1 Low1 blocked by ARMR today1 Working exploit published1 20083 Protected by Waratek3 Medium3 blocked by ARMR today3 Working exploit published3 20093 Protected by Waratek3 High1 Medium2 blocked by ARMR today3 Working exploit published3 20101 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20110 20120 20130 20141 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20152 Protected by Waratek2 Medium2 blocked by ARMR today2 Working exploit published2 20162 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 Working exploit published2 20172 Protected by Waratek2 Medium2 blocked by ARMR today2 Working exploit published2 20182 Protected by Waratek2 Medium2 blocked by ARMR today2 Working exploit published2 20192 Protected by Waratek2 Medium2 blocked by ARMR today2 Working exploit published2 20201 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20211 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20222 Protected by Waratek2 High2 blocked by ARMR today2 Working exploit published2 20230 20242 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 Working exploit published2 20251 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20262 Protected by Waratek1 Mitigation candidate1 High2 blocked by ARMR today1 not blocked1 Working exploit published2
200420062008201020122014201620182020202220242026
30 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-55552 High 2026-08-28 Protected by Waratek Working exploit published Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0.
CVE-2026-22739 High 2026-03-24 Mitigation candidate Working exploit published Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from 3.1.X before 3.1.13, from 4.1.X before 4.1.9, from 4.2.X before 4.2.3, from 4.3.X before 4.3.2, from 5.0.X before 5.0.2.
CVE-2025-41242 Medium 2025-08-18 Protected by Waratek Working exploit published Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an embedded Servlet container * the Servlet container does not reject suspicious sequences https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1.html#uri-path-canonicalization * the application serves static resources https://docs.spring.io/spring-framework/reference/web/webmvc/mvc-config/static-resources.html#page-title  with Spring resource handling We have verified that applications deployed on Apache Tomcat or Eclipse Jetty are not vulnerable, as long as default security features are not disabled in the configuration. Because we cannot check exploits against all Servlet containers and configuration variants, we strongly recommend upgrading your application.
CVE-2024-38819 High 2024-12-19 Protected by Waratek Working exploit published Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application is running.
CVE-2024-24565 Medium 2024-01-30 Protected by Waratek Working exploit published CrateDB is a distributed SQL database that makes it simple to store and analyze massive amounts of data in real-time. There is a COPY FROM function in the CrateDB database that is used to import file data into database tables. This function has a flaw, and authenticated attackers can use the COPY FROM function to import arbitrary file content into database tables, resulting in information leakage. This vulnerability is patched in 5.3.9, 5.4.8, 5.5.4, and 5.6.1.
CVE-2022-31268 High 2022-05-21 Protected by Waratek Working exploit published A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
CVE-2021-44138 High 2022-04-04 Protected by Waratek Working exploit published There is a Directory traversal vulnerability in Caucho Resin, as distributed in Resin 4.0.52 - 4.0.56, which allows remote attackers to read files in arbitrary directories via a ; in a pathname within an HTTP request.
CVE-2020-6950 Medium 2021-06-02 Protected by Waratek Working exploit published Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVE-2020-5405 Medium 2020-03-05 Protected by Waratek Working exploit published Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
CVE-2019-13237 Medium 2019-08-27 Protected by Waratek Working exploit published In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
CVE-2019-3799 Medium 2019-05-06 Protected by Waratek Working exploit published Spring Cloud Config, versions 2.1.x prior to 2.1.2, versions 2.0.x prior to 2.0.4, and versions 1.4.x prior to 1.4.6, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
CVE-2018-1271 Medium 2018-04-06 Protected by Waratek Working exploit published Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
CVE-2017-10273 Medium 2018-01-18 Protected by Waratek Working exploit published Vulnerability in the Oracle JDeveloper component of Oracle Fusion Middleware (subcomponent: Deployment). Supported versions that are affected are 11.1.1.7.0, 11.1.1.7.1, 11.1.1.9.0, 11.1.2.4.0, 12.1.3.0.0 and 12.2.1.2.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle JDeveloper executes to compromise Oracle JDeveloper. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle JDeveloper, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle JDeveloper accessible data as well as unauthorized read access to a subset of Oracle JDeveloper accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle JDeveloper. CVSS 3.0 Base Score 4.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L).
CVE-2016-4314 Medium 2017-02-17 Protected by Waratek Working exploit published Directory traversal vulnerability in the LogViewer Admin Service in WSO2 Carbon 4.4.5 allows remote authenticated administrators to read arbitrary files via a .. (dot dot) in the logFile parameter to downloadgz-ajaxprocessor.jsp.
CVE-2016-5725 Medium 2017-01-19 Protected by Waratek Working exploit published Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.
CVE-2016-0784 Medium 2016-04-11 Protected by Waratek Working exploit published Directory traversal vulnerability in the Import/Export System Backups functionality in Apache OpenMeetings before 3.1.1 allows remote authenticated administrators to write to arbitrary files via a .. (dot dot) in a ZIP archive entry.
CVE-2016-0709 High 2016-04-11 Protected by Waratek Working exploit published Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files, and consequently execute arbitrary code, via a .. (dot dot) in a ZIP archive entry, as demonstrated by "../../webapps/x.jsp."
CVE-2015-1830 Medium 2015-08-19 Protected by Waratek Working exploit published Directory traversal vulnerability in the fileserver upload/download functionality for blob messages in Apache ActiveMQ 5.x before 5.11.2 for Windows allows remote attackers to create JSP files in arbitrary directories via unspecified vectors.
CVE-2015-3337 Medium 2015-05-01 Protected by Waratek Working exploit published Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
CVE-2011-4367 Medium 2014-06-19 Protected by Waratek Working exploit published Multiple directory traversal vulnerabilities in MyFaces JavaServer Faces (JSF) in Apache MyFaces Core 2.0.x before 2.0.12 and 2.1.x before 2.1.6 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) ln parameter to faces/javax.faces.resource/web.xml or (2) the PATH_INFO to faces/javax.faces.resource/.
CVE-2010-3863 Medium 2010-11-05 Protected by Waratek Working exploit published Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
CVE-2009-1523 Medium 2009-05-05 Protected by Waratek Working exploit published Directory traversal vulnerability in the HTTP server in Mort Bay Jetty 5.1.14, 6.x before 6.1.17, and 7.x through 7.0.0.M2 allows remote attackers to access arbitrary files via directory traversal sequences in the URI.
CVE-2008-5518 High 2009-04-17 Protected by Waratek Working exploit published Multiple directory traversal vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 on Windows allow remote attackers to upload files to arbitrary directories via directory traversal sequences in the (1) group, (2) artifact, (3) version, or (4) fileType parameter to console/portal//Services/Repository (aka the Services/Repository portlet); the (5) createDB parameter to console/portal/Embedded DB/DB Manager (aka the Embedded DB/DB Manager portlet); or the (6) filename parameter to the createKeystore script in the Security/Keystores portlet.
CVE-2008-6505 Medium 2009-03-23 Protected by Waratek Working exploit published Multiple directory traversal vulnerabilities in Apache Struts 2.0.x before 2.0.12 and 2.1.x before 2.1.3 allow remote attackers to read arbitrary files via a ..%252f (encoded dot dot slash) in a URI with a /struts/ path, related to (1) FilterDispatcher in 2.0.x and (2) DefaultStaticContentLoader in 2.1.x.
CVE-2008-2938 Medium 2008-08-13 Protected by Waratek Working exploit published Directory traversal vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when allowLinking and UTF-8 are enabled, allows remote attackers to read arbitrary files via encoded directory traversal sequences in the URI, a different vulnerability than CVE-2008-2370. NOTE: versions earlier than 6.0.18 were reported affected, but the vendor advisory lists 6.0.16 as the last affected version.
CVE-2008-2370 Medium 2008-08-04 Protected by Waratek Working exploit published Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16, when a RequestDispatcher is used, performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
CVE-2008-1301 Medium 2008-03-12 Protected by Waratek Working exploit published Absolute path traversal vulnerability in system/workplace/admin/workplace/logfileview/logfileViewSettings.jsp in Alkacon OpenCms 7.0.3 and 7.0.4 allows remote authenticated administrators to read arbitrary files via a full pathname in the filePath.0 parameter.
CVE-2007-5461 Low 2007-10-15 Protected by Waratek Working exploit published Absolute path traversal vulnerability in Apache Tomcat 4.0.0 through 4.0.6, 4.1.0, 5.0.0, 5.5.0 through 5.5.25, and 6.0.0 through 6.0.14, under certain configurations, allows remote authenticated users to read arbitrary files via a WebDAV write request that specifies an entity with a SYSTEM tag.
CVE-2006-2758 Medium 2006-06-02 Protected by Waratek Working exploit published Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary files via a %2e%2e%5c (encoded ../) in the URL. NOTE: this might be the same issue as CVE-2005-3747.
CVE-2003-0042 Medium 2003-02-07 Protected by Waratek Working exploit published Jakarta Tomcat before 3.3.1a, when used with JDK 1.3.1 or earlier, allows remote attackers to list directories even with an index.html or other file present, or obtain unprocessed source code for a JSP file, via a URL containing a null character.