WaratekVRT Sign in
Reset
More filters (1)
Columns
CWE CWE-285✕
Overview 114 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
114matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 114 100.0%
Critical 14 12.3% High 30 26.3% Medium 67 58.8% Low 3 2.6% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 114 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 9 7.9% Forecast only 0 0.0% No public exploit 105 92.1%
split by peak 41 / year
No exploit published: 114 Low: 3Medium: 67High: 30Critical: 14 not blocked: 114 No public exploit: 105Proof of concept only: 9
20171 No exploit published1 High1 not blocked1 No public exploit1 20183 No exploit published3 Critical1 High1 Medium1 not blocked3 No public exploit3 201916 No exploit published16 Critical1 High4 Medium11 not blocked16 No public exploit16 202020 No exploit published20 Critical1 High2 Medium16 Low1 not blocked20 No public exploit20 20212 No exploit published2 Critical1 High1 not blocked2 No public exploit2 20223 No exploit published3 High3 not blocked3 Proof of concept only2 No public exploit1 20230 202417 No exploit published17 Critical3 High5 Medium9 not blocked17 No public exploit17 202511 No exploit published11 Critical1 High3 Medium7 not blocked11 Proof of concept only4 No public exploit7 202641 No exploit published41 Critical6 High10 Medium23 Low2 not blocked41 Proof of concept only3 No public exploit38
2017201820192020202120222023202420252026
114 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2019-17631 Critical 2019-10-17 No exploit published No public exploit From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks.
CVE-2019-10439 Medium 2019-10-16 No exploit published No public exploit A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier in various 'doFillCredentialsIdItems' methods allowed users with Overall/Read access to enumerate credentials ID of credentials stored in Jenkins.
CVE-2019-10438 Medium 2019-10-16 No exploit published No public exploit A missing permission check in Jenkins CRX Content Package Deployer Plugin 1.8.1 and earlier allowed attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
CVE-2019-10357 Medium 2019-07-31 No exploit published No public exploit A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.
CVE-2019-10344 Medium 2019-07-31 No exploit published No public exploit Missing permission checks in Jenkins Configuration as Code Plugin 1.24 and earlier in various HTTP endpoints allowed users with Overall/Read access to access the generated schema and documentation for this plugin containing detailed information about installed plugins.
CVE-2018-8029 High 2019-05-30 No exploit published No public exploit In Apache Hadoop versions 3.0.0-alpha1 to 3.1.0, 2.9.0 to 2.9.1, and 2.2.0 to 2.8.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.
CVE-2019-0212 High 2019-03-28 No exploit published No public exploit In all previously released Apache HBase 2.x versions (2.0.0-2.0.4, 2.1.0-2.1.3), authorization was incorrectly applied to users of the HBase REST server. Requests sent to the HBase REST server were executed with the permissions of the REST server itself, not with the permissions of the end-user. This issue is only relevant when HBase is configured with Kerberos authentication, HBase authorization is enabled, and the REST server is configured with SPNEGO authentication. This issue does not extend beyond the HBase REST server.
CVE-2019-1003004 High 2019-01-22 No exploit published No public exploit An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/AuthenticationProcessingFilter2.java that allows attackers to extend the duration of active HTTP sessions indefinitely even though the user account may have been deleted in the mean time.
CVE-2019-1003003 High 2019-01-22 No exploit published No public exploit An improper authorization vulnerability exists in Jenkins 2.158 and earlier, LTS 2.150.1 and earlier in core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java that allows attackers with Overall/RunScripts permission to craft Remember Me cookies that would never expire, allowing e.g. to persist access to temporarily compromised user accounts.
CVE-2018-1000408 Medium 2019-01-09 No exploit published No public exploit A denial of service vulnerability exists in Jenkins 2.145 and earlier, LTS 2.138.1 and earlier in core/src/main/java/hudson/security/HudsonPrivateSecurityRealm.java that allows attackers without Overall/Read permission to access a specific URL on instances using the built-in Jenkins user database security realm that results in the creation of an ephemeral user record in memory.
CVE-2018-14637 High 2018-11-30 No exploit published No public exploit The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
CVE-2017-2589 Critical 2018-07-26 No exploit published No public exploit It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed between the client and the end URL) which means all clients using that proxy are sharing the same cookies.
CVE-2018-1000107 Medium 2018-03-13 No exploit published No public exploit An improper authorization vulnerability exists in Jenkins Job and Node Ownership Plugin 0.11.0 and earlier in OwnershipDescription.java, JobOwnerJobProperty.java, and OwnerNodeProperty.java that allow an attacker with Job/Configure or Computer/Configure permission and without Ownership related permissions to override ownership metadata.
CVE-2017-12160 High 2017-10-26 No exploit published No public exploit It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
‹ prev page 2 of 2 next ›