VRT Sign in

Medium CWE-94 CVEs with a working exploit

3 CVEs, 2 protected by Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 2 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5

3matches 2protected66.7% 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.533.3%

Protected by Waratek 2 66.7% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 0 0.0%

Critical 0 0.0% High 0 0.0% Medium 3 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 66.7% partly blocked 0 0.0% not blocked 1 33.3% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 3 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q2 101 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Q3 100 Q4 100 Q1 110 Q2 110 Q3 110 Q4 110 Q1 120 Q2 120 Q3 120 Q4 121 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 Q1 130 Q2 130 Q3 130 Q4 131 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1

Q2 10Q4 10Q2 11Q4 11Q2 12Q4 12Q2 13Q4 13

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2013-6366	Medium	2013-11-04	Protected by Waratek	Working exploit published	The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime().exec call.
CVE-2011-2732	Medium	2012-12-05	Mitigation candidate	Working exploit published	CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
CVE-2010-1622	Medium	2010-06-21	Protected by Waratek	Working exploit published	SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2013-6366

Medium

2013-11-04

Protected by Waratek

Working exploit published

The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime().exec call.

CVE-2011-2732

Medium

2012-12-05

Mitigation candidate

Working exploit published

CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.

CVE-2010-1622

Medium

2010-06-21

Protected by Waratek

Working exploit published

SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.