WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕CWE CWE-863✕
Overview 6 matches · 2 protected · 3 exploited · 0 CISA KEV · 4 public PoC
6matches 2protected33.3% 3exploited50.0% 0CISA KEV0.0% 4public PoC66.7%
Protected by Waratek 2 33.3% Rule in development 0 0.0% Mitigation candidate 2 33.3% No exploit published 2 33.3%
Critical 3 50.0% High 0 0.0% Medium 3 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 33.3% partly blocked 0 0.0% not blocked 4 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 50.0% Working exploit published 1 16.7% Proof of concept only 0 0.0% Forecast only 2 33.3% No public exploit 0 0.0%
split by peak 2 / quarter
No exploit published: 2Mitigation candidate: 2Protected by Waratek: 2 Medium: 3Critical: 3 not blocked: 4blocked by ARMR today: 2 Forecast only: 2Working exploit published: 1Exploited: 3
Q4 201 No exploit published1 Critical1 not blocked1 Forecast only1 Q1 210 Q2 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Q3 212 Protected by Waratek1 Mitigation candidate1 Medium2 blocked by ARMR today1 not blocked1 Exploited2 Q4 210 Q1 220 Q2 220 Q3 220 Q4 220 Q1 230 Q2 231 No exploit published1 Critical1 not blocked1 Forecast only1 Q3 230 Q4 230 Q1 240 Q2 240 Q3 240 Q4 241 Mitigation candidate1 Critical1 not blocked1 Exploited1
Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-45216 Critical 2024-10-16 Mitigation candidate Exploited Improper Authentication vulnerability in Apache Solr. Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the original URL Path. This fake ending looks like an unprotected API path, however it is stripped off internally after authentication but before API routing. This issue affects Apache Solr: from 5.3.0 before 8.11.4, from 9.0.0 before 9.7.0. Users are recommended to upgrade to version 9.7.0, or 8.11.4, which fix the issue.
CVE-2023-35166 Critical 2023-06-20 No exploit published Forecast only XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. This has been patched in XWiki 15.1-rc-1 and 14.10.5.
CVE-2021-36749 Medium 2021-09-24 Mitigation candidate Exploited In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
CVE-2021-34429 Medium 2021-07-15 Protected by Waratek Exploited For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
CVE-2021-28164 Medium 2021-04-01 Protected by Waratek Working exploit published In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVE-2020-13957 Critical 2020-10-13 No exploit published Forecast only Apache Solr versions 6.6.0 to 6.6.6, 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.