VRT Sign in

CWE-77 CVEs with a working exploit

3 CVEs, 3 protected by Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5

3matches 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.533.3%

Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%

Critical 1 33.3% High 1 33.3% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 3 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / year

20111 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20120 20130 20141 Protected by Waratek1 High1 blocked by ARMR today1 Working exploit published1 20150 20160 20170 20180 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1

201120122013201420152016201720182019

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2013-7285	Critical	2019-05-15	Protected by Waratek	Working exploit published	Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.
CVE-2014-1216	High	2014-04-22	Protected by Waratek	Working exploit published	FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.
CVE-2011-1571	Medium	2011-05-07	Protected by Waratek	Working exploit published	Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2013-7285

Critical

2019-05-15

Protected by Waratek

Working exploit published

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

CVE-2014-1216

High

2014-04-22

Protected by Waratek

Working exploit published

FitNesse Wiki 20131110, 20140201, and earlier allows remote attackers to execute arbitrary commands by defining a COMMAND_PATTERN and TEST_RUNNER in the pageContent parameter when editing a page.

CVE-2011-1571

Medium

2011-05-07

Protected by Waratek

Working exploit published

Unspecified vulnerability in the XSL Content portlet in Liferay Portal Community Edition (CE) 5.x and 6.x before 6.0.6 GA, when Apache Tomcat is used, allows remote attackers to execute arbitrary commands via unknown vectors.