WaratekVRT Sign in

CWE-285 CVEs

118 CVEs, 1 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-285✕
Overview 118 matches · 1 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
118matches 1protected0.8% 0exploited0.0% 0CISA KEV0.0% 3public PoC2.5% 1EPSS ≥ 0.50.8%
Protected by Waratek 1 0.8% Rule in development 0 0.0% Mitigation candidate 3 2.5% No exploit published 114 96.6%
Critical 16 13.6% High 32 27.1% Medium 67 56.8% Low 3 2.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 0.8% partly blocked 0 0.0% not blocked 117 99.2% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 0.8% Proof of concept only 11 9.3% Forecast only 0 0.0% No public exploit 106 89.8%
split by peak 41 / year
No exploit published: 114Mitigation candidate: 3Protected by Waratek: 1 Low: 3Medium: 67High: 32Critical: 16 not blocked: 117blocked by ARMR today: 1 No public exploit: 106Proof of concept only: 11Working exploit published: 1
20141 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20150 20160 20171 No exploit published1 High1 not blocked1 No public exploit1 20183 No exploit published3 Critical1 High1 Medium1 not blocked3 No public exploit3 201916 No exploit published16 Critical1 High4 Medium11 not blocked16 No public exploit16 202020 No exploit published20 Critical1 High2 Medium16 Low1 not blocked20 No public exploit20 20212 No exploit published2 Critical1 High1 not blocked2 No public exploit2 20225 Mitigation candidate2 No exploit published3 Critical2 High3 not blocked5 Proof of concept only4 No public exploit1 20231 Mitigation candidate1 High1 not blocked1 Working exploit published1 202417 No exploit published17 Critical3 High5 Medium9 not blocked17 No public exploit17 202511 No exploit published11 Critical1 High3 Medium7 not blocked11 Proof of concept only4 No public exploit7 202641 No exploit published41 Critical6 High10 Medium23 Low2 not blocked41 Proof of concept only3 No public exploit38
2014201620182020202220242026
118 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2019-3641 Medium 2019-11-13 No exploit published No public exploit Abuse of Authorization vulnerability in APIs exposed by TIE server in McAfee Threat Intelligence Exchange Server (TIE Server) 3.0.0 allows remote authenticated users to modify stored reputation data via specially crafted messages.
CVE-2019-10470 Medium 2019-10-23 No exploit published No public exploit A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin in form-related methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2019-10469 Medium 2019-10-23 No exploit published No public exploit A missing permission check in Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-17631 Critical 2019-10-17 No exploit published No public exploit From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.
CVE-2019-10439 Medium 2019-10-16 No exploit published No public exploit A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2019-10438 Medium 2019-10-16 No exploit published No public exploit A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10357 Medium 2019-07-31 No exploit published No public exploit A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.
CVE-2019-10344 Medium 2019-07-31 No exploit published No public exploit Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins.
CVE-2018-8029 High 2019-05-30 No exploit published No public exploit In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
CVE-2019-0212 High 2019-03-28 No exploit published No public exploit In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.
CVE-2019-1003004 High 2019-01-22 No exploit published No public exploit An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
CVE-2019-1003003 High 2019-01-22 No exploit published No public exploit An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
CVE-2018-1000408 Medium 2019-01-09 No exploit published No public exploit A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances using the built-in Jenkins user database security realm that results in the creation of an ephemeral user record in memory.
CVE-2018-14637 High 2018-11-30 No exploit published No public exploit The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
CVE-2017-2589 Critical 2018-07-26 No exploit published No public exploit It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
CVE-2018-1000107 Medium 2018-03-13 No exploit published No public exploit An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, JobOwnerJobProperty.java, and OwnerNodeProperty.java that allow an attacker with Job/Configure or Computer/Configure permission and without Ownership related permissions to override ownership metadata.
CVE-2017-12160 High 2017-10-26 No exploit published No public exploit It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
CVE-2014-0107 High 2014-04-15 Protected by Waratek No public exploit The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.
‹ prev page 2 of 2 next ›