WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-611✕
Overview 10 matches · 3 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC
10matches 3in Waratek scope30.0% 2protected20.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 2 20.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 10.0% Outside Waratek scope 0 0.0% Not applicable 7 70.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 8 80.0% Medium 2 20.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 20.0% partly blocked 0 0.0% not blocked 8 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 10 100.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 7No exploit published: 1Protected by Waratek: 2 Medium: 2High: 8 not blocked: 8blocked by ARMR today: 2 Forecast only: 10
20141 Protected by Waratek1 Medium1 blocked by ARMR today1 Forecast only1 20150 20160 20170 20180 20190 20202 Not applicable2 High2 not blocked2 Forecast only2 20213 Protected by Waratek1 No exploit published1 Not applicable1 High2 Medium1 blocked by ARMR today1 not blocked2 Forecast only3 20221 Not applicable1 High1 not blocked1 Forecast only1 20230 20243 Not applicable3 High3 not blocked3 Forecast only3
20142015201620172018201920202021202220232024
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-53675 High 2024-11-26 Not applicable Forecast only An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.
CVE-2024-37397 High 2024-09-12 Not applicable Forecast only An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.
CVE-2023-44412 High 2024-05-03 Not applicable Forecast only D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of D-Link D-View. Authentication is not required to exploit this vulnerability. The specific flaw exists within the addDv7Probe function. Due to the improper restriction of XML External Entity (XXE) references, a crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-19571.
CVE-2022-38419 High 2022-10-14 Not applicable Forecast only Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. Exploitation of this issue does not require user interaction.
CVE-2021-2401 Medium 2021-07-21 No exploit published Forecast only Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: E-Business Suite - XDO). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle BI Publisher accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2021-21659 High 2021-05-25 Protected by Waratek Forecast only Jenkins URLTrigger Plugin 0.48 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2020-27858 High 2021-01-20 Not applicable Forecast only This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getNews method. Due to the improper restriction of XML External Entity (XXE) references, a specially-crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-11103.
CVE-2020-17408 High 2020-09-10 Not applicable Forecast only This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. Authentication is not required to exploit this vulnerability. The specific flaw exists within the clpwebmc executable. Due to the improper restriction of XML External Entity (XXE) references, a specially-crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-10801.
CVE-2020-15419 High 2020-07-28 Not applicable Forecast only This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Reporter_ImportLicense class. Due to the improper restriction of XML External Entity (XXE) references, a specially crafted document specifying a URI causes the XML parser to access the URI and embed the contents back into the XML document for further processing. An attacker can leverage this vulnerability to disclose file contents in the context of SYSTEM. Was ZDI-CAN-10710.
CVE-2013-6429 Medium 2014-01-26 Protected by Waratek Forecast only The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.