WaratekVRT Sign in

CWE-400 CVEs with a working exploit

5 CVEs

Reset
More filters (1)
Columns
CWE CWE-400✕
Overview 5 matches · 0 protected · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
5matches 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 3EPSS ≥ 0.560.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 5 100.0% No exploit published 0 0.0%
Critical 0 0.0% High 3 60.0% Medium 2 40.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 5 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / year
Mitigation candidate: 5 Medium: 2High: 3 not blocked: 5 Working exploit published: 5
20031 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20040 20050 20060 20070 20080 20090 20100 20111 Mitigation candidate1 High1 not blocked1 Working exploit published1 20121 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20130 20140 20150 20160 20170 20180 20190 20201 Mitigation candidate1 High1 not blocked1 Working exploit published1 20210 20221 Mitigation candidate1 High1 not blocked1 Working exploit published1
2004200620082010201220142016201820202022
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-29885 High 2022-05-12 Mitigation candidate Working exploit published The documentation of Apache Tomcat 10.1.0-M1 to 10.1.0-M14, 10.0.0-M1 to 10.0.20, 9.0.13 to 9.0.62 and 8.5.38 to 8.5.78 for the EncryptInterceptor incorrectly stated it enabled Tomcat clustering to run over an untrusted network. This was not correct. While the EncryptInterceptor does provide confidentiality and integrity protection, it does not protect against all risks associated with running over any untrusted network, particularly DoS risks.
CVE-2020-13951 High 2020-09-30 Mitigation candidate Working exploit published Attackers can use public NetTest web service of Apache OpenMeetings 4.0.0-5.0.0 to organize denial of service attack.
CVE-2012-2138 Medium 2012-07-09 Mitigation candidate Working exploit published The @CopyFrom operation in the POST servlet in the org.apache.sling.servlets.post bundle before 2.1.2 in Apache Sling does not prevent attempts to copy an ancestor node to a descendant node, which allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP request.
CVE-2011-5034 High 2011-12-30 Mitigation candidate Working exploit published Apache Geronimo 2.2.1 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters. NOTE: this might overlap CVE-2011-4461.
CVE-2003-0866 Medium 2003-11-17 Mitigation candidate Working exploit published The Catalina org.apache.catalina.connector.http package in Tomcat 4.0.x up to 4.0.3 allows remote attackers to cause a denial of service via several requests that do not follow the HTTP protocol, which causes Tomcat to reject later requests.