CWE-787 CVEs | Waratek

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

2matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%

Critical 1 50.0% High 0 0.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 50.0% Forecast only 0 0.0% No public exploit 1 50.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Sep 221 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1 Oct 220 Nov 221 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1

Sep 22Oct 22Nov 22

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2022-42920	Critical	2022-11-07	Protected by Waratek	No public exploit	Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.
CVE-2022-38752	Medium	2022-09-05	Protected by Waratek	Proof of concept only	Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2022-42920

Critical

2022-11-07

Protected by Waratek

No public exploit

Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue, these APIs can be used to produce arbitrary bytecode. This could be abused in applications that pass attacker-controllable data to those APIs, giving the attacker more control over the resulting bytecode than otherwise expected. Update to Apache Commons BCEL 6.6.0.

CVE-2022-38752

Medium

2022-09-05

Protected by Waratek

Proof of concept only

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.