WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-320✕
Overview 20 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
20matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 5.0% Not applicable 19 95.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 20 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 20 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 20 100.0%
split by peak 5 / year
Not applicable: 19Outside Waratek scope: 1 High: 20 not blocked: 20 No public exploit: 20
20141 Not applicable1 High1 not blocked1 No public exploit1 20150 20161 Not applicable1 High1 not blocked1 No public exploit1 20175 Not applicable5 High5 not blocked5 No public exploit5 20185 Not applicable5 High5 not blocked5 No public exploit5 20194 Outside Waratek scope1 Not applicable3 High4 not blocked4 No public exploit4 20200 20211 Not applicable1 High1 not blocked1 No public exploit1 20220 20232 Not applicable2 High2 not blocked2 No public exploit2 20240 20250 20261 Not applicable1 High1 not blocked1 No public exploit1
2014201620182020202220242026
20 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-56254 High 2026-07-10 Not applicable No public exploit In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can be derived from the private key, an attacker performing a man-in-the-middle attack or compromising the Capgo server can create a validly signed update bundle and cause devices to install an update not produced by the original app maker.
CVE-2023-21652 High 2023-08-08 Not applicable No public exploit Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.
CVE-2023-21626 High 2023-08-08 Not applicable No public exploit Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.
CVE-2021-26322 High 2021-11-16 Not applicable No public exploit Persistent platform private key may not be protected with a random IV leading to a potential “two time pad attack”.
CVE-2019-12621 High 2019-08-21 Not applicable No public exploit A vulnerability in Cisco HyperFlex Software could allow an unauthenticated, remote attacker to perform a man-in-the-middle attack. The vulnerability is due to insufficient key management. An attacker could exploit this vulnerability by obtaining a specific encryption key for the cluster. A successful exploit could allow the attacker to perform a man-in-the-middle attack against other nodes in the cluster.
CVE-2015-1316 High 2019-04-22 Not applicable No public exploit Juju Core's Joyent provider before version 1.25.5 uploads the user's private ssh key.
CVE-2019-9894 High 2019-03-21 Outside Waratek scope No public exploit A remotely triggerable memory overwrite in RSA key exchange in PuTTY before 0.71 can occur before host key verification.
CVE-2017-13887 High 2019-01-11 Not applicable No public exploit In macOS High Sierra before 10.13.2, a logic issue existed in APFS when deleting keys during hibernation. This was addressed with improved state management.
CVE-2016-8614 High 2018-07-31 Not applicable No public exploit A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
CVE-2018-0732 High 2018-06-12 Not applicable No public exploit During key agreement in a TLS handshake using a DH(E) based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This could be exploited in a Denial Of Service attack. Fixed in OpenSSL 1.1.0i-dev (Affected 1.1.0-1.1.0h). Fixed in OpenSSL 1.0.2p-dev (Affected 1.0.2-1.0.2o).
CVE-2013-2233 High 2018-05-04 Not applicable No public exploit Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.
CVE-2015-0153 High 2018-04-12 Not applicable No public exploit D-Link DIR-815 devices with firmware before 2.07.B01 allow remote attackers to obtain sensitive information by leveraging cleartext storage of the wireless key.
CVE-2018-9234 High 2018-04-04 Not applicable No public exploit GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.
CVE-2015-7503 High 2017-10-10 Not applicable No public exploit Zend Framework before 2.4.9, zend-framework/zend-crypt 2.4.x before 2.4.9, and 2.5.x before 2.5.2 allows remote attackers to recover the RSA private key.
CVE-2015-0839 High 2017-08-02 Not applicable No public exploit The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) makes it easier for man-in-the-middle attackers to execute arbitrary code by leveraging use of a short GPG key id from a keyserver to verify print plugin downloads.
CVE-2016-6879 High 2017-04-10 Not applicable No public exploit The X509_Certificate::allowed_usage function in botan 1.11.x before 1.11.31 might allow attackers to have unspecified impact by leveraging a call with more than one Key_Usage set in the enum value.
CVE-2016-2880 High 2017-03-01 Not applicable No public exploit IBM QRadar 7.2 stores the encryption key used to encrypt the service account password which can be obtained by a local user. IBM Reference #: 1997340.
CVE-2016-6886 High 2017-01-13 Not applicable No public exploit The pstm_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via a (1) zero value or (2) the key's modulus for the secret key during RSA key exchange.
CVE-2015-8542 High 2016-12-15 Not applicable No public exploit An issue was discovered in Open-Xchange Guard before 2.2.0-rev8. The "getprivkeybyid" API call is used to download a PGP Private Key for a specific user after providing authentication credentials. Clients provide the "id" and "cid" parameter to specify the current user by its user- and context-ID. The "auth" parameter contains a hashed password string which gets created by the client by asking the user to enter his or her OX Guard password. This parameter is used as single point of authentication when accessing PGP Private Keys. In case a user has set the same password as another user, it is possible to download another user's PGP Private Key by iterating the "id" and "cid" parameters. This kind of attack would also be able by brute-forcing login credentials, but since the "id" and "cid" parameters are sequential they are much easier to predict than a user's login name. At the same time, there are some obvious insecure standard passwords that are widely used. A attacker could send the hashed representation of typically weak passwords and randomly fetch Private Key of matching accounts. The attack can be executed by both internal users and "guests" which use the external mail reader.
CVE-2014-2361 High 2014-07-24 Not applicable No public exploit OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules, when BreeZ is used, do not require authentication for reading the site security key, which allows physically proximate attackers to spoof communication by obtaining this key after use of direct hardware access or manual-setup mode.