WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-917✕
Overview 221 matches · 50 in Waratek scope · 9 protected · 15 exploited · 9 CISA KEV · 18 public PoC · 11 EPSS ≥ 0.5
221matches 50in Waratek scope22.6% 9protected4.1% 15exploited6.8% 9CISA KEV4.1% 18public PoC8.1% 11EPSS ≥ 0.55.0%
Protected by Waratek 9 4.1% Rule in development 0 0.0% Mitigation candidate 5 2.3% No exploit published 36 16.3% Outside Waratek scope 1 0.5% Not applicable 170 76.9% Withdrawn CVE 0 0.0%
Critical 85 38.5% High 117 52.9% Medium 19 8.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 9 4.1% partly blocked 0 0.0% not blocked 212 95.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 15 6.8% Working exploit published 2 0.9% Proof of concept only 15 6.8% Forecast only 1 0.5% No public exploit 188 85.1%
split by peak 68 / year
Not applicable: 170Outside Waratek scope: 1No exploit published: 36Mitigation candidate: 5Protected by Waratek: 9 Medium: 19High: 117Critical: 85 not blocked: 212blocked by ARMR today: 9 No public exploit: 188Forecast only: 1Proof of concept only: 15Working exploit published: 2Exploited: 15
20091 No exploit published1 Medium1 not blocked1 No public exploit1 20101 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20110 20120 20130 20140 20150 20160 20171 No exploit published1 High1 not blocked1 No public exploit1 20183 Mitigation candidate1 No exploit published1 Not applicable1 Critical2 High1 not blocked3 Proof of concept only1 No public exploit2 201963 Not applicable63 Critical6 High57 not blocked63 Exploited1 Forecast only1 No public exploit61 202068 Protected by Waratek2 No exploit published2 Not applicable64 Critical40 High28 blocked by ARMR today2 not blocked66 Exploited2 Working exploit published2 No public exploit64 20217 Protected by Waratek3 Outside Waratek scope1 Not applicable3 Critical5 High1 Medium1 blocked by ARMR today3 not blocked4 Exploited4 No public exploit3 202211 Protected by Waratek3 Mitigation candidate2 No exploit published1 Not applicable5 Critical6 High3 Medium2 blocked by ARMR today3 not blocked8 Exploited5 Proof of concept only2 No public exploit4 202311 No exploit published6 Not applicable5 Critical4 High4 Medium3 not blocked11 Proof of concept only1 No public exploit10 20248 No exploit published1 Not applicable7 Critical4 Medium4 not blocked8 Proof of concept only2 No public exploit6 20254 Mitigation candidate1 No exploit published2 Not applicable1 Critical2 High1 Medium1 not blocked4 Exploited1 Proof of concept only1 No public exploit2 202643 Mitigation candidate1 No exploit published21 Not applicable21 Critical16 High20 Medium7 not blocked43 Exploited1 Proof of concept only8 No public exploit34
201020122014201620182020202220242026
221 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2019-11959 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11958 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11955 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11954 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11953 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11952 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11951 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11949 Critical 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11948 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11943 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11942 High 2019-06-05 Not applicable No public exploit A remote code execution vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
CVE-2019-11628 High 2019-05-01 Not applicable No public exploit An issue was discovered in QlikView Server before 11.20 SR19, 12.00 and 12.10 before 12.10 SR11, 12.20 before SR9, and 12.30 before SR2; and Qlik Sense Enterprise and Qlik Analytics Platform installations that lack these patch levels: February 2018 Patch 4, April 2018 Patch 3, June 2018 Patch 3, September 2018 Patch 4, November 2018 Patch 4, or February 2019 Patch 2. An authenticated user may be able to bypass intended file-read restrictions via crafted Browser requests.
CVE-2019-9041 High 2019-02-23 Not applicable Exploited An issue was discovered in ZZZCMS zzzphp V1.6.1. In the inc/zzz_template.php file, the parserIfLabel() function's filtering is not strict, resulting in PHP code execution, as demonstrated by the if:assert substring.
CVE-2019-5916 Critical 2019-02-13 Not applicable No public exploit Input validation issue in POWER EGG(Ver 2.0.1, Ver 2.02 Patch 3 and earlier, Ver 2.1 Patch 4 and earlier, Ver 2.2 Patch 7 and earlier, Ver 2.3 Patch 9 and earlier, Ver 2.4 Patch 13 and earlier, Ver 2.5 Patch 12 and earlier, Ver 2.6 Patch 8 and earlier, Ver 2.7 Patch 6 and earlier, Ver 2.7 Government Edition Patch 7 and earlier, Ver 2.8 Patch 6 and earlier, Ver 2.8c Patch 5 and earlier, Ver 2.9 Patch 4 and earlier) allows remote attackers to execute EL expression on the server via unspecified vectors.
CVE-2019-7743 Critical 2019-02-12 Not applicable No public exploit An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection mechanism (such as the TYPO3 PHAR stream wrapper) to prevent use of the phar:// handler for non .phar-files.
CVE-2018-16621 High 2018-11-15 Not applicable No public exploit Sonatype Nexus Repository Manager before 3.14 allows Java Expression Language Injection.
CVE-2018-12533 Critical 2018-06-18 Mitigation candidate Proof of concept only JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.
CVE-2018-12532 Critical 2018-06-18 No exploit published No public exploit JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309.
CVE-2011-4343 High 2017-08-08 No exploit published No public exploit Information disclosure vulnerability in Apache MyFaces Core 2.0.1 through 2.0.10 and 2.1.0 through 2.1.4 allows remote attackers to inject EL expressions via crafted parameters.
CVE-2010-1871 High 2010-08-05 Protected by Waratek Exploited JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.
CVE-2009-1275 Medium 2009-04-09 No exploit published No public exploit Apache Tiles 2.1 before 2.1.2, as used in Apache Struts and other products, evaluates Expression Language (EL) expressions twice in certain circumstances, which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information via unspecified vectors, related to the (1) tiles:putAttribute and (2) tiles:insertTemplate JSP tags.
‹ prev page 3 of 3 next ›