WaratekVRT Sign in

CWE-89 CVEs

114 CVEs, 10 exploited, 91 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-89✕
Overview 114 matches · 91 protected · 10 exploited · 0 CISA KEV · 13 public PoC · 6 EPSS ≥ 0.5
114matches 91protected79.8% 10exploited8.8% 0CISA KEV0.0% 13public PoC11.4% 6EPSS ≥ 0.55.3%
Protected by Waratek 91 79.8% Rule in development 0 0.0% Mitigation candidate 6 5.3% No exploit published 17 14.9%
Critical 42 36.8% High 46 40.4% Medium 25 21.9% Low 0 0.0% None 0 0.0% Unknown 1 0.9%
blocked by ARMR today 91 79.8% partly blocked 0 0.0% not blocked 23 20.2% not established 0 0.0% unrecorded 0 0.0%
Exploited 10 8.8% Working exploit published 4 3.5% Proof of concept only 14 12.3% Forecast only 0 0.0% No public exploit 86 75.4%
split by peak 38 / year
No exploit published: 17Mitigation candidate: 6Protected by Waratek: 91 Unknown: 1Medium: 25High: 46Critical: 42 not blocked: 23blocked by ARMR today: 91 No public exploit: 86Proof of concept only: 14Working exploit published: 4Exploited: 10
20072 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 No public exploit2 20080 20090 20100 20110 20120 20132 Protected by Waratek2 High1 Medium1 blocked by ARMR today2 Working exploit published2 20140 20150 20164 Protected by Waratek4 Critical1 High2 Medium1 blocked by ARMR today4 Working exploit published1 No public exploit3 20174 Protected by Waratek4 Critical2 High1 Medium1 blocked by ARMR today4 Working exploit published1 No public exploit3 20181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20192 Protected by Waratek2 Critical1 Medium1 blocked by ARMR today2 No public exploit2 20207 Protected by Waratek7 Critical4 High2 Medium1 blocked by ARMR today7 No public exploit7 20215 Protected by Waratek5 High4 Medium1 blocked by ARMR today5 Proof of concept only1 No public exploit4 202214 Protected by Waratek14 Critical8 High4 Medium2 blocked by ARMR today14 Exploited1 Proof of concept only1 No public exploit12 202316 Protected by Waratek15 Mitigation candidate1 Critical9 High5 Medium2 blocked by ARMR today15 not blocked1 Exploited2 Proof of concept only4 No public exploit10 20249 Protected by Waratek7 Mitigation candidate1 No exploit published1 Critical4 High3 Medium1 Unknown1 blocked by ARMR today7 not blocked2 Exploited2 Proof of concept only2 No public exploit5 202510 Protected by Waratek7 Mitigation candidate3 Critical5 High3 Medium2 blocked by ARMR today7 not blocked3 Exploited4 Proof of concept only1 No public exploit5 202638 Protected by Waratek21 Mitigation candidate1 No exploit published16 Critical7 High20 Medium11 blocked by ARMR today21 not blocked17 Exploited1 Proof of concept only5 No public exploit32
2008201020122014201620182020202220242026
114 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2019-3797 Medium 2019-05-06 Protected by Waratek No public exploit This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
CVE-2018-1282 Critical 2018-04-05 Protected by Waratek No public exploit This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.
CVE-2017-7681 High 2017-07-17 Protected by Waratek No public exploit Apache OpenMeetings 1.0.0 is vulnerable to SQL injection. This allows authenticated users to modify the structure of the existing query and leak the structure of other queries being made by the application in the back-end.
CVE-2017-4974 Medium 2017-06-13 Protected by Waratek No public exploit An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA endpoints."
CVE-2017-3549 Critical 2017-04-24 Protected by Waratek Working exploit published Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2016-8027 Critical 2017-03-14 Protected by Waratek No public exploit SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query, which can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.
CVE-2016-6652 Medium 2016-10-05 Protected by Waratek No public exploit SQL injection vulnerability in Pivotal Spring Data JPA before 1.9.6 (Gosling SR6) and 1.10.x before 1.10.4 (Hopper SR4), when used with a repository that defines a String query using the @Query annotation, allows attackers to execute arbitrary JPQL commands via a sort instance with a function call.
CVE-2016-4999 Critical 2016-08-05 Protected by Waratek No public exploit SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.
CVE-2016-2174 High 2016-06-13 Protected by Waratek No public exploit SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
CVE-2016-0710 High 2016-04-11 Protected by Waratek Working exploit published Multiple SQL injection vulnerabilities in the User Manager service in Apache Jetspeed before 2.3.1 allow remote attackers to execute arbitrary SQL commands via the (1) role or (2) user parameter to services/usermanager/users/.
CVE-2013-4882 Medium 2013-07-22 Protected by Waratek Working exploit published Multiple SQL injection vulnerabilities in McAfee ePolicy Orchestrator 4.6.6 and earlier, and the ePolicy Orchestrator (ePO) extension for McAfee Agent (MA) 4.5 and 4.6, allow remote authenticated users to execute arbitrary SQL commands via the uid parameter to (1) core/showRegisteredTypeDetails.do and (2) EPOAGENTMETA/DisplayMSAPropsDetail.do, a different vulnerability than CVE-2013-0140.
CVE-2013-0140 High 2013-05-01 Protected by Waratek Working exploit published SQL injection vulnerability in the Agent-Handler component in McAfee ePolicy Orchestrator (ePO) before 4.5.7 and 4.6.x before 4.6.6 allows remote attackers to execute arbitrary SQL commands via a crafted request over the Agent-Server communication channel.
CVE-2007-5766 High 2007-11-08 Protected by Waratek No public exploit SQL injection vulnerability in okxLOV.jsp in Oracle E-Business Suite 11 and 12 allows remote attackers to execute arbitrary SQL commands via unknown vectors. NOTE: this is probably the same issue as CVE-2007-5527 or CVE-2007-5528, but there are insufficient details to be sure.
CVE-2006-7217 Medium 2007-07-05 Protected by Waratek No public exploit Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
‹ prev page 2 of 2 next ›