WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕CWE CWE-287✕
Overview 8 matches · 1 protected · 5 exploited · 2 CISA KEV · 6 public PoC
8matches 1protected12.5% 5exploited62.5% 2CISA KEV25.0% 6public PoC75.0%
Protected by Waratek 1 12.5% Rule in development 1 12.5% Mitigation candidate 4 50.0% No exploit published 2 25.0%
Critical 4 50.0% High 2 25.0% Medium 2 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 12.5% partly blocked 0 0.0% not blocked 7 87.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 5 62.5% Working exploit published 1 12.5% Proof of concept only 0 0.0% Forecast only 2 25.0% No public exploit 0 0.0%
split by peak 2 / year
No exploit published: 2Mitigation candidate: 4Rule in development: 1Protected by Waratek: 1 Medium: 2High: 2Critical: 4 not blocked: 7blocked by ARMR today: 1 Forecast only: 2Working exploit published: 1Exploited: 5
20021 No exploit published1 Medium1 not blocked1 Forecast only1 20030 20040 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20181 Mitigation candidate1 Medium1 not blocked1 Exploited1 20190 20200 20212 Mitigation candidate1 No exploit published1 Critical2 not blocked2 Exploited1 Forecast only1 20220 20231 Protected by Waratek1 High1 blocked by ARMR today1 Working exploit published1 20241 Mitigation candidate1 Critical1 not blocked1 Exploited1 20252 Rule in development1 Mitigation candidate1 Critical1 High1 not blocked2 Exploited2
200320052007200920112013201520172019202120232025
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-61884 High 2025-10-12 Rule in development Exploited Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2025-61882 Critical 2025-10-05 Mitigation candidate Exploited Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Concurrent Processing. Successful attacks of this vulnerability can result in takeover of Oracle Concurrent Processing. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2024-45216 Critical 2024-10-16 Mitigation candidate Exploited Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
CVE-2022-41678 High 2023-11-28 Protected by Waratek Working exploit published Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePostRequest is able to create JmxRequest through JSONObject. And calls to org.jolokia.http.HttpRequestHandler#executeRequest. Into deeper calling stacks, org.jolokia.handler.ExecHandler#doHandleRequest can be invoked through refection. This could lead to RCE through via various mbeans. One example is unrestricted deserialization in jdk.management.jfr.FlightRecorderMXBeanImpl which exists on Java version above 11. 1 Call newRecording. 2 Call setConfiguration. And a webshell data hides in it. 3 Call startRecording. 4 Call copyTo method. The webshell will be written to a .jsp file. The mitigation is to restrict (by default) the actions authorized on Jolokia, or disable Jolokia. A more restrictive Jolokia configuration has been defined in default ActiveMQ distribution. We encourage users to upgrade to ActiveMQ distributions version including updated Jolokia configuration: 5.16.6, 5.17.4, 5.18.0, 6.0.0.
CVE-2021-41303 Critical 2021-09-17 No exploit published Forecast only Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. Users should update to Apache Shiro 1.8.0.
CVE-2020-17523 Critical 2021-02-03 Mitigation candidate Exploited Apache Shiro before 1.7.1, when using Apache Shiro with Spring, a specially crafted HTTP request may cause an authentication bypass.
CVE-2018-11770 Medium 2018-08-13 Mitigation candidate Exploited From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit. In standalone, the config property 'spark.authenticate.secret' establishes a shared secret for authenticating requests to submit jobs via spark-submit. However, the REST API does not use this or any other authentication mechanism, and this is not adequately documented. In this case, a user would be able to run a driver program without authenticating, but not launch executors, using the REST API. This REST API is also used by Mesos, when set up to run in cluster mode (i.e., when also running MesosClusterDispatcher), for job submission. Future versions of Spark will improve documentation on these points, and prohibit setting 'spark.authenticate.secret' when running the REST APIs, to make this clear. Future versions will also disable the REST API by default in the standalone master by changing the default value of 'spark.master.rest.enabled' to 'false'.
CVE-2002-0563 Medium 2002-07-03 No exploit published Forecast only The default configuration of Oracle 9i Application Server 1.0.2.x allows remote anonymous users to access sensitive services without authentication, including Dynamic Monitoring Services (1) dms0, (2) dms/DMSDump, (3) servlet/DMSDump, (4) servlet/Spy, (5) soap/servlet/Spy, and (6) dms/AggreSpy; and Oracle Java Process Manager (7) oprocmgr-status and (8) oprocmgr-service, which can be used to control Java processes.