WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-669✕
Overview 130 matches · 4 in Waratek scope · 0 protected · 7 exploited · 3 CISA KEV · 7 public PoC · 1 EPSS ≥ 0.5
130matches 4in Waratek scope3.1% 0protected0.0% 7exploited5.4% 3CISA KEV2.3% 7public PoC5.4% 1EPSS ≥ 0.50.8%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 3.1% Outside Waratek scope 2 1.5% Not applicable 124 95.4% Withdrawn CVE 0 0.0%
Critical 13 10.0% High 53 40.8% Medium 47 36.2% Low 17 13.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 130 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 7 5.4% Working exploit published 1 0.8% Proof of concept only 21 16.2% Forecast only 0 0.0% No public exploit 101 77.7%
split by peak 57 / year
Not applicable: 124Outside Waratek scope: 2No exploit published: 4 Low: 17Medium: 47High: 53Critical: 13 not blocked: 130 No public exploit: 101Proof of concept only: 21Working exploit published: 1Exploited: 7
20021 Not applicable1 Medium1 not blocked1 No public exploit1 20030 20041 Not applicable1 Medium1 not blocked1 No public exploit1 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20150 20161 Not applicable1 Critical1 not blocked1 No public exploit1 20171 Not applicable1 Medium1 not blocked1 No public exploit1 20180 201912 No exploit published3 Not applicable9 Critical1 High9 Medium2 not blocked12 Proof of concept only1 No public exploit11 202010 Not applicable10 Critical3 High2 Medium5 not blocked10 Exploited1 Working exploit published1 Proof of concept only1 No public exploit7 20219 Not applicable9 Critical1 High4 Medium4 not blocked9 Exploited2 Proof of concept only1 No public exploit6 20229 Outside Waratek scope1 Not applicable8 Critical2 High5 Medium2 not blocked9 Proof of concept only1 No public exploit8 20236 Not applicable6 Critical1 High3 Medium2 not blocked6 No public exploit6 20244 Outside Waratek scope1 Not applicable3 High2 Medium2 not blocked4 Proof of concept only1 No public exploit3 202519 No exploit published1 Not applicable18 Critical1 High6 Medium4 Low8 not blocked19 Exploited1 Proof of concept only7 No public exploit11 202657 Not applicable57 Critical3 High22 Medium23 Low9 not blocked57 Exploited3 Proof of concept only9 No public exploit45
2002200420062008201020122014201620182020202220242026
130 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2021-22900 High 2021-05-27 Not applicable Exploited A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to perform a file write via a maliciously crafted archive upload in the administrator web interface.
CVE-2021-21531 High 2021-04-30 Not applicable No public exploit Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulnerability to perform unauthorized actions.
CVE-2021-20411 High 2021-02-12 Not applicable No public exploit IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user to impersonate another user on the system due to incorrectly updating the session identifier. IBM X-Force ID: 198191.
CVE-2020-27268 Medium 2021-01-19 Not applicable No public exploit In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass checks for default PINs via Bluetooth Low Energy.
CVE-2020-25917 High 2020-12-26 Not applicable No public exploit Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with "helpdesk" privileges, can perform privileged operations including adding a new administrator to the platform via the easyadmin/user/submitCreateTCUser.do page.
CVE-2020-24683 Critical 2020-12-22 Not applicable No public exploit The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.
CVE-2020-26177 Medium 2020-12-18 Not applicable No public exploit In tangro Business Workflow before 1.18.1, a user's profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibited server-side.
CVE-2020-5800 Critical 2020-12-07 Not applicable No public exploit The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify information that they would not normally have access to.
CVE-2020-15257 Medium 2020-12-01 Not applicable Proof of concept only containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the "host" network namespace, for example with docker run --net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container's privilege, regardless of what container runtime is used for running that container.
CVE-2020-10778 Medium 2020-08-11 Not applicable No public exploit In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.
CVE-2020-15892 Critical 2020-07-22 Not applicable No public exploit An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length of 15 characters. The problem is that validation is being done on the client side, hence it can be bypassed. When an attacker manages to intercept the login request (POST based) and tampers with the vulnerable parameter (log_pass), to a larger length, the request will be forwarded to the webserver. This results in a stack-based buffer overflow. A few other POST variables, (transferred as part of the login request) are also vulnerable: html_response_page and log_user.
CVE-2020-1048 High 2020-05-21 Not applicable Exploited An elevation of privilege vulnerability exists when the Windows Print Spooler service improperly allows arbitrary writing to the file system. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted script or application. The update addresses the vulnerability by correcting how the Windows Print Spooler Component writes to the file system.
CVE-2020-5188 Medium 2020-02-24 Not applicable No public exploit DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.
CVE-2020-6862 Medium 2020-01-17 Not applicable Working exploit published V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page information without entering a verification code.
CVE-2012-2979 High 2019-11-01 Not applicable No public exploit FreeBSD NSD before 3.2.13 allows remote attackers to crash a NSD child server process (SIGSEGV) and cause a denial of service in the NSD server.
CVE-2019-13025 Critical 2019-10-02 Not applicable Proof of concept only Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a maliciously modified POST (HTTP) request containing shell commands, which will be executed on the device, to an backend API endpoint of the cable modem.
CVE-2019-10753 Medium 2019-09-05 No exploit published No public exploit In all versions prior to version 3.9.6 for eclipse-wtp, all versions prior to version 9.4.4 for eclipse-cdt, and all versions prior to version 3.0.1 for eclipse-groovy, Spotless was resolving dependencies over an insecure channel (http). If the build occurred over an insecure connection, a malicious user could have perform a Man-in-the-Middle attack during the build and alter the build artifacts that were produced. In case that any of these artifacts were compromised, any developers using these could be altered. **Note:** In order to validate that this artifact was not compromised, the maintainer would need to confirm that none of the artifacts published to the registry were not altered with. Until this happens, we can not guarantee that this artifact was not compromised even though the probability that this happened is low.
CVE-2019-13266 High 2019-08-27 Not applicable No public exploit TP-Link Archer C3200 V1 and Archer C2 V1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field.
CVE-2019-13263 High 2019-08-27 Not applicable No public exploit D-link DIR-825AC G1 devices have Insufficient Compartmentalization between a host network and a guest network that are established by the same device. A DHCP Request is sent to the router with a certain Transaction ID field. Following the DHCP protocol, the router responds with an ACK or NAK message. Studying the NAK case revealed that the router erroneously sends the NAK to both Host and Guest networks with the same Transaction ID as found in the DHCP Request. This allows encoding of data to be sent cross-router into the 32-bit Transaction ID field.
CVE-2018-17791 High 2019-08-21 Not applicable No public exploit Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an "improper server side validation" vulnerability where client-side validations are tampered, and inappropriate information is stored on the server side and fetched from the server every time the user visits the D, creating business confusion. In the worst case, all available resources are consumed while processing the data, resulting in unavailability of the service to legitimate users. This occurs because non-editable parameters can be modified by manually editing a disabled form field within the developer options.
CVE-2019-1020011 High 2019-07-29 Not applicable No public exploit SmokeDetector intentionally does automatic deployments of updated copies of SmokeDetector without server operator authority.
CVE-2019-11770 High 2019-06-14 Not applicable No public exploit In Eclipse Buildship versions prior to 3.1.1, the build files indicate that this project is resolving dependencies over HTTP instead of HTTPS. Any of these artifacts could have been MITM to maliciously compromise them and infect the build artifacts that were produced. Additionally, if any of these JARs or other dependencies were compromised, any developers using these could continue to be infected past updating to fix this.
CVE-2019-12728 High 2019-06-04 No exploit published No public exploit Grails before 3.3.10 used cleartext HTTP to resolve the SDKMan notification service. NOTE: users' apps were not resolving dependencies over cleartext HTTP.
CVE-2019-11875 High 2019-05-24 Not applicable No public exploit In AutomateAppCore.dll in Blue Prism Robotic Process Automation 6.4.0.8445, a vulnerability in access control can be exploited to escalate privileges. The vulnerability allows for abusing the application for fraud or unauthorized access to certain information. The attack requires a valid user account to connect to the Blue Prism server, but the roles associated to this account are not required to have any permissions. First of all, the application files are modified to grant full permissions on the client side. In a test environment (or his own instance of the software) an attacker is able to grant himself full privileges also on the server side. He can then, for instance, create a process with malicious behavior and export it to disk. With the modified client, it is possible to import the exported file as a release and overwrite any existing process in the database. Eventually, the bots execute the malicious process. The server does not check the user's permissions for the aforementioned actions, such that a modification of the client software enables this kind of attack. Possible scenarios may involve changing bank accounts or setting passwords.
CVE-2019-10248 High 2019-04-22 No exploit published No public exploit Eclipse Vorto versions prior to 0.11 resolved Maven build artifacts for the Xtext project over HTTP instead of HTTPS. Any of these dependent artifacts could have been maliciously compromised by a MITM attack. Hence produced build artifacts of Vorto might be infected.
CVE-2019-0042 Medium 2019-04-10 Not applicable No public exploit Juniper Identity Management Service (JIMS) for Windows versions prior to 1.1.4 may send an incorrect message to associated SRX services gateways. This may allow an attacker with physical access to an existing domain connected Windows system to bypass SRX firewall policies, or trigger a Denial of Service (DoS) condition for the network.
CVE-2017-14013 Medium 2017-10-17 Not applicable No public exploit A Client-Side Enforcement of Server-Side Security issue was discovered in ProMinent MultiFLEX M10a Controller web interface. The log out function in the application removes the user's session only on the client side. This may allow an attacker to bypass protection mechanisms, gain privileges, or assume the identity of an authenticated user.
CVE-2016-5062 Critical 2016-09-29 Not applicable No public exploit The web server in Aternity before 9.0.1 does not require authentication for getMBeansFromURL loading of Java MBeans, which allows remote attackers to execute arbitrary Java code by registering MBeans.
CVE-2004-0872 Medium 2004-09-16 Not applicable No public exploit Opera does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."
CVE-2002-0055 Medium 2002-03-08 Not applicable No public exploit SMTP service in Microsoft Windows 2000, Windows XP Professional, and Exchange 2000 allows remote attackers to cause a denial of service via a command with a malformed data transfer (BDAT) request.
‹ prev page 2 of 2 next ›