WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-327✕
Overview 9 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5
9matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2EPSS ≥ 0.522.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 9 100.0% Withdrawn CVE 0 0.0%
Critical 4 44.4% High 1 11.1% Medium 4 44.4% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 9 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 9 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 9 Medium: 4High: 1Critical: 4 not blocked: 9 Working exploit published: 9
20172 Not applicable2 Critical2 not blocked2 Working exploit published2 20180 20191 Not applicable1 Medium1 not blocked1 Working exploit published1 20201 Not applicable1 Medium1 not blocked1 Working exploit published1 20210 20222 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20231 Not applicable1 Critical1 not blocked1 Working exploit published1 20241 Not applicable1 Medium1 not blocked1 Working exploit published1 20251 Not applicable1 Critical1 not blocked1 Working exploit published1
201720182019202020212022202320242025
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-3365 Critical 2025-01-28 Not applicable Working exploit published Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved.
CVE-2024-22318 Medium 2024-02-09 Not applicable Working exploit published IBM i Access Client Solutions (ACS) 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.4 is vulnerable to NT LAN Manager (NTLM) hash disclosure by an attacker modifying UNC capable paths within ACS configuration files to point to a hostile server. If NTLM is enabled, the Windows operating system will try to authenticate using the current user's session. The hostile server could capture the NTLM hash information to obtain the user's credentials. IBM X-Force ID: 279091.
CVE-2023-34039 Critical 2023-08-29 Not applicable Working exploit published Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI.
CVE-2022-35513 High 2022-09-07 Not applicable Working exploit published The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.
CVE-2022-0377 Medium 2022-02-28 Not applicable Working exploit published Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.
CVE-2020-6857 Medium 2020-01-21 Not applicable Working exploit published CarbonFTP v1.4 uses insecure proprietary password encryption with a hard-coded weak encryption key. The key for local FTP server passwords is hard-coded in the binary.
CVE-2019-16116 Medium 2019-10-02 Not applicable Working exploit published EnterpriseDT CompleteFTP Server prior to version 12.1.3 is vulnerable to information exposure in the Bootstrap.log file. This allows an attacker to obtain the administrator password hash.
CVE-2014-8687 Critical 2017-06-08 Not applicable Working exploit published Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.
CVE-2016-6602 Critical 2017-01-23 Not applicable Working exploit published ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml. NOTE: this issue can be combined with CVE-2016-6601 for a remote exploit.