WaratekVRT Sign in
Reset
More filters (1)
Columns
CWE CWE-502✕
Overview 11 matches · 0 protected · 1 exploited · 0 CISA KEV · 9 public PoC · 2 EPSS ≥ 0.5
11matches 0protected0.0% 1exploited9.1% 0CISA KEV0.0% 9public PoC81.8% 2EPSS ≥ 0.518.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 11 100.0% No exploit published 0 0.0%
Critical 0 0.0% High 11 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 9.1% Working exploit published 4 36.4% Proof of concept only 5 45.5% Forecast only 0 0.0% No public exploit 1 9.1%
split by peak 6 / year
Mitigation candidate: 11 High: 11 not blocked: 11 No public exploit: 1Proof of concept only: 5Working exploit published: 4Exploited: 1
20131 Mitigation candidate1 High1 not blocked1 No public exploit1 20140 20150 20161 Mitigation candidate1 High1 not blocked1 Working exploit published1 20170 20180 20190 20202 Mitigation candidate2 High2 not blocked2 Proof of concept only2 20216 Mitigation candidate6 High6 not blocked6 Exploited1 Working exploit published3 Proof of concept only2 20220 20230 20241 Mitigation candidate1 High1 not blocked1 Proof of concept only1
201320142015201620172018201920202021202220232024
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-22871 High 2024-02-29 Mitigation candidate Proof of concept only An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn__5920 function.
CVE-2021-39152 High 2021-08-23 Mitigation candidate Exploited XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.
CVE-2021-39146 High 2021-08-23 Mitigation candidate Working exploit published XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVE-2021-39141 High 2021-08-23 Mitigation candidate Working exploit published XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVE-2021-29505 High 2021-05-28 Mitigation candidate Working exploit published XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
CVE-2020-36179 High 2021-01-07 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
CVE-2020-36184 High 2021-01-06 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
CVE-2020-35728 High 2020-12-27 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
CVE-2020-10673 High 2020-03-18 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVE-2016-0792 High 2016-04-07 Mitigation candidate Working exploit published Multiple unspecified API endpoints in Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVE-2013-1768 High 2013-07-11 Mitigation candidate No public exploit The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.