WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-776✕
Overview 109 matches · 22 in Waratek scope · 21 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
109matches 22in Waratek scope20.2% 21protected19.3% 0exploited0.0% 0CISA KEV0.0% 3public PoC2.8% 1EPSS ≥ 0.50.9%
Protected by Waratek 21 19.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 0.9% Outside Waratek scope 4 3.7% Not applicable 82 75.2% Withdrawn CVE 1 0.9%
Critical 10 9.2% High 56 51.4% Medium 40 36.7% Low 2 1.8% None 0 0.0% Unknown 1 0.9%
blocked by ARMR today 21 19.3% partly blocked 0 0.0% not blocked 88 80.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 1.8% Proof of concept only 10 9.2% Forecast only 0 0.0% No public exploit 97 89.0%
split by peak 38 / year
Withdrawn CVE: 1Not applicable: 82Outside Waratek scope: 4No exploit published: 1Protected by Waratek: 21 Unknown: 1Low: 2Medium: 40High: 56Critical: 10 not blocked: 88blocked by ARMR today: 21 No public exploit: 97Proof of concept only: 10Working exploit published: 2
20031 Not applicable1 Medium1 not blocked1 No public exploit1 20040 20050 20060 20070 20081 Not applicable1 Medium1 not blocked1 No public exploit1 20091 Not applicable1 High1 not blocked1 Working exploit published1 20100 20112 Not applicable2 High2 not blocked2 No public exploit2 20120 20130 20141 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20150 20160 20171 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20180 20199 Protected by Waratek4 Outside Waratek scope2 Not applicable3 High7 Medium2 blocked by ARMR today4 not blocked5 Working exploit published1 No public exploit8 202012 Protected by Waratek1 Outside Waratek scope1 Not applicable10 Critical3 High6 Medium3 blocked by ARMR today1 not blocked11 No public exploit12 20219 Protected by Waratek2 Not applicable7 Critical1 High3 Medium5 blocked by ARMR today2 not blocked7 No public exploit9 202211 Protected by Waratek2 Outside Waratek scope1 Not applicable8 Critical1 High6 Medium4 blocked by ARMR today2 not blocked9 No public exploit11 202310 Protected by Waratek4 Not applicable5 Withdrawn CVE1 Critical3 High3 Medium3 Unknown1 blocked by ARMR today4 not blocked6 Proof of concept only3 No public exploit7 20248 Protected by Waratek1 Not applicable7 High2 Medium6 blocked by ARMR today1 not blocked7 Proof of concept only1 No public exploit7 20255 Not applicable5 Critical1 High1 Medium3 not blocked5 Proof of concept only2 No public exploit3 202638 Protected by Waratek5 No exploit published1 Not applicable32 Critical1 High25 Medium10 Low2 blocked by ARMR today5 not blocked33 Proof of concept only4 No public exploit34
200420062008201020122014201620182020202220242026
109 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2019-5442 High 2019-06-12 Protected by Waratek No public exploit XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.
CVE-2019-5427 High 2019-04-22 Protected by Waratek No public exploit c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
CVE-2017-5644 Medium 2017-03-24 Protected by Waratek No public exploit Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
CVE-2014-1868 Medium 2014-10-06 Protected by Waratek No public exploit Restlet Framework 2.1.x before 2.1.7 and 2.x.x before 2.2 RC1, when using XMLRepresentation or XML serializers, allows attackers to cause a denial of service via an XML Entity Expansion (XEE) attack.
CVE-2011-3288 High 2011-10-06 Not applicable No public exploit Cisco Unified Presence before 8.5(4) does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption, and process crash) via a crafted XML document containing a large number of nested entity references, aka Bug IDs CSCtq89842 and CSCtq88547, a similar issue to CVE-2003-1564.
CVE-2011-1755 High 2011-06-21 Not applicable No public exploit jabberd2 before 2.2.14 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, a similar issue to CVE-2003-1564.
CVE-2009-1955 High 2009-06-08 Not applicable Working exploit published The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.
CVE-2008-3281 Medium 2008-08-27 Not applicable No public exploit libxml2 2.6.32 and earlier does not properly detect recursion during entity expansion in an attribute value, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document.
CVE-2003-1564 Medium 2003-12-31 Not applicable No public exploit libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."
‹ prev page 2 of 2 next ›