CWE-840 CVEs | Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 110 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

110matches 2in Waratek scope1.8% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 1.8% Outside Waratek scope 1 0.9% Not applicable 107 97.3% Withdrawn CVE 0 0.0%

Critical 5 4.5% High 21 19.1% Medium 61 55.5% Low 23 20.9% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 110 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 44 40.0% Forecast only 0 0.0% No public exploit 66 60.0%

split by StatusSeverityProtectionExploit maturity peak 41 / year

20192 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20203 Not applicable3 Medium3 not blocked3 No public exploit3 20216 Not applicable6 High1 Medium5 not blocked6 Proof of concept only3 No public exploit3 202215 No exploit published1 Outside Waratek scope1 Not applicable13 Critical4 High4 Medium7 not blocked15 Proof of concept only5 No public exploit10 202312 Not applicable12 High2 Medium8 Low2 not blocked12 Proof of concept only5 No public exploit7 202413 Not applicable13 Critical1 High4 Medium7 Low1 not blocked13 Proof of concept only4 No public exploit9 202518 Not applicable18 High7 Medium9 Low2 not blocked18 Proof of concept only6 No public exploit12 202641 No exploit published1 Not applicable40 High2 Medium21 Low18 not blocked41 Proof of concept only21 No public exploit20

20192020202120222023202420252026

110 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2021-4111	Medium	2021-12-15	Not applicable	No public exploit	yetiforcecrm is vulnerable to Business Logic Errors
CVE-2021-36012	Medium	2021-09-01	Not applicable	No public exploit	Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
CVE-2021-22926	High	2021-08-05	Not applicable	Proof of concept only	libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.
CVE-2021-22922	Medium	2021-08-05	Not applicable	Proof of concept only	When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.
CVE-2021-22897	Medium	2021-06-11	Not applicable	Proof of concept only	curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.
CVE-2020-8228	Medium	2020-10-05	Not applicable	No public exploit	A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.
CVE-2020-8181	Medium	2020-07-10	Not applicable	No public exploit	A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.
CVE-2019-15608	Medium	2020-03-15	Not applicable	No public exploit	The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.
CVE-2019-3787	High	2019-06-19	Not applicable	No public exploit	Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.
CVE-2019-3789	Medium	2019-04-24	Not applicable	No public exploit	Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2021-4111

Medium

2021-12-15

Not applicable

No public exploit

yetiforcecrm is vulnerable to Business Logic Errors

CVE-2021-36012

Medium

2021-09-01

Not applicable

No public exploit

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.

CVE-2021-22926

High

2021-08-05

Not applicable

Proof of concept only

libcurl-using applications can ask for a specific client certificate to be used in a transfer. This is done with the `CURLOPT_SSLCERT` option (`--cert` with the command line tool).When libcurl is built to use the macOS native TLS library Secure Transport, an application can ask for the client certificate by name or with a file name - using the same option. If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by name, and thereby trick the application to use the file based cert instead of the one referred to by name making libcurl send the wrong client certificate in the TLS connection handshake.

CVE-2021-22922

Medium

2021-08-05

Not applicable

Proof of concept only

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

CVE-2021-22897

Medium

2021-06-11

Not applicable

Proof of concept only

curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly.

CVE-2020-8228

Medium

2020-10-05

Not applicable

No public exploit

A missing rate limit in the Preferred Providers app 1.7.0 allowed an attacker to set the password an uncontrolled amount of times.

CVE-2020-8181

Medium

2020-07-10

Not applicable

No public exploit

A missing file type check in Nextcloud Contacts 3.2.0 allowed a malicious user to upload any file as avatars.

CVE-2019-15608

Medium

2020-03-15

Not applicable

No public exploit

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.

CVE-2019-3787

High

2019-06-19

Not applicable

No public exploit

Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending “unknown.org” to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to a potentially fraudulent address. This would allow the attacker to gain complete control of the user's account.

CVE-2019-3789

Medium

2019-04-24

Not applicable

No public exploit

Cloud Foundry Routing Release, all versions prior to 0.188.0, contains a vulnerability that can hijack the traffic to route services hosted outside the platform. A user with space developer permissions can create a private domain that shadows the external domain of the route service, and map that route to an app. When the gorouter receives traffic destined for the external route service, this traffic will instead be directed to the internal app using the shadow route.