WaratekVRT Sign in

CWE-749 CVEs

6 CVEs, 2 exploited, 2 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-749✕
Overview 6 matches · 2 protected · 2 exploited · 2 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
6matches 2protected33.3% 2exploited33.3% 2CISA KEV33.3% 1public PoC16.7% 2EPSS ≥ 0.533.3%
Protected by Waratek 2 33.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 66.7%
Critical 2 33.3% High 2 33.3% Medium 2 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 33.3% partly blocked 0 0.0% not blocked 4 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 33.3% Working exploit published 0 0.0% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 3 50.0%
split by peak 3 / year
No exploit published: 4Protected by Waratek: 2 Medium: 2High: 2Critical: 2 not blocked: 4blocked by ARMR today: 2 No public exploit: 3Proof of concept only: 1Exploited: 2
20061 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20070 20080 20090 20101 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20110 20120 20130 20140 20150 20160 20170 20180 20190 20200 20210 20220 20233 No exploit published3 Critical2 High1 not blocked3 No public exploit3 20240 20251 No exploit published1 Medium1 not blocked1 Proof of concept only1
2007200920112013201520172019202120232025
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-6863 Medium 2025-03-20 No exploit published Proof of concept only In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerability makes it possible for an attacker to encrypt arbitrary files with keys of their choice, making it exceedingly difficult for the target to recover the keys needed for decryption.
CVE-2023-50424 Critical 2023-12-12 No exploit published No public exploit SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
CVE-2023-50422 Critical 2023-12-12 No exploit published No public exploit SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
CVE-2023-26478 High 2023-03-02 No exploit published No public exploit XWiki Platform is a generic wiki platform. Starting in version 14.3-rc-1, `org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment` returns an instance of `com.xpn.xwiki.doc.XWikiAttachment`. This class is not supported to be exposed to users without the `programing` right. `com.xpn.xwiki.api.Attachment` should be used instead and takes case of checking the user's rights before performing dangerous operations. This has been patched in versions 14.9-rc-1 and 14.4.6. There are no known workarounds for this issue.
CVE-2010-0738 Medium 2010-04-28 Protected by Waratek Exploited The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.
CVE-2006-1547 High 2006-03-30 Protected by Waratek Exploited ActionForm in Apache Software Foundation (ASF) Struts before 1.2.9 with BeanUtils 1.7 allows remote attackers to cause a denial of service via a multipart/form-data encoded form with a parameter name that references the public getMultipartRequestHandler method, which provides further access to elements in the CommonsMultipartRequestHandler implementation and BeanUtils.