WaratekVRT Sign in

CWE-94 CVEs

229 CVEs, 30 exploited, 47 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-94✕
Overview 229 matches · 45 protected · 30 exploited · 16 CISA KEV · 41 public PoC · 43 EPSS ≥ 0.5
split by peak 54 / year
No exploit published: 161Mitigation candidate: 21Protected by Waratek: 47 Low: 4Medium: 29High: 77Critical: 119 not blocked: 182partly blocked: 2blocked by ARMR today: 45 No public exploit: 123Forecast only: 7Proof of concept only: 58Working exploit published: 11Exploited: 30
20073 No exploit published3 Medium3 not blocked3 No public exploit3 20081 No exploit published1 High1 not blocked1 No public exploit1 20093 No exploit published3 High2 Medium1 not blocked3 No public exploit3 20101 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20110 20122 Protected by Waratek1 Mitigation candidate1 Critical1 Medium1 blocked by ARMR today1 not blocked1 Exploited1 Working exploit published1 20139 Protected by Waratek2 Mitigation candidate3 No exploit published4 High6 Medium3 blocked by ARMR today2 not blocked7 Exploited2 Working exploit published3 No public exploit4 201410 Mitigation candidate1 No exploit published9 High2 Medium8 not blocked10 Working exploit published1 No public exploit9 20150 20161 No exploit published1 Medium1 not blocked1 No public exploit1 20170 20187 Protected by Waratek6 No exploit published1 Critical6 Medium1 blocked by ARMR today6 not blocked1 Exploited2 Proof of concept only1 Forecast only1 No public exploit3 20196 Protected by Waratek3 Mitigation candidate1 No exploit published2 Critical3 High3 blocked by ARMR today2 partly blocked1 not blocked3 Exploited3 Forecast only1 No public exploit2 20206 Protected by Waratek2 No exploit published4 Critical2 High3 Medium1 blocked by ARMR today2 not blocked4 Exploited1 No public exploit5 20219 Protected by Waratek2 Mitigation candidate2 No exploit published5 Critical5 High4 blocked by ARMR today2 not blocked7 Exploited2 Working exploit published2 Forecast only2 No public exploit3 202218 Protected by Waratek8 Mitigation candidate1 No exploit published9 Critical16 High1 Medium1 blocked by ARMR today8 not blocked10 Exploited5 Working exploit published1 Proof of concept only4 No public exploit8 202352 Protected by Waratek8 Mitigation candidate2 No exploit published42 Critical40 High10 Medium2 blocked by ARMR today8 not blocked44 Exploited4 Working exploit published1 Proof of concept only29 Forecast only2 No public exploit16 202430 Protected by Waratek3 Mitigation candidate6 No exploit published21 Critical20 High8 Medium2 blocked by ARMR today2 partly blocked1 not blocked27 Exploited6 Working exploit published1 Proof of concept only8 Forecast only1 No public exploit14 202517 Protected by Waratek2 Mitigation candidate1 No exploit published14 Critical4 High10 Medium1 Low2 blocked by ARMR today2 not blocked15 Exploited2 Proof of concept only5 No public exploit10 202654 Protected by Waratek9 Mitigation candidate3 No exploit published42 Critical22 High27 Medium3 Low2 blocked by ARMR today9 not blocked45 Exploited2 Proof of concept only11 No public exploit41
2008201020122014201620182020202220242026
229 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2014-3065 Medium 2014-12-02 No exploit published No public exploit Unspecified vulnerability in IBM Java Runtime Environment (JRE) 7 R1 before SR2 (7.1.2.0), 7 before SR8 (7.0.8.0), 6 R1 before SR8 FP2 (6.1.8.2), 6 before SR16 FP2 (6.0.16.2), and before SR16 FP8 (5.0.16.8) allows local users to execute arbitrary code via vectors related to the shared classes cache.
CVE-2014-3666 High 2014-10-16 No exploit published No public exploit Jenkins before 1.583 and LTS before 1.565.3 allows remote attackers to execute arbitrary code via a crafted packet to the CLI channel.
CVE-2013-4444 Medium 2014-09-12 No exploit published No public exploit Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40, in certain situations involving outdated java.io.File code and a custom JMX configuration, allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.
CVE-2014-4767 Medium 2014-08-22 No exploit published No public exploit IBM WebSphere Application Server (WAS) Liberty Profile 8.5.x before 8.5.5.3 does not properly use the Liberty Repository for feature installation, which allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2014-3518 Medium 2014-07-22 No exploit published No public exploit jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2014-0248 Medium 2014-07-07 No exploit published No public exploit org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.
CVE-2013-6469 Medium 2014-04-22 No exploit published No public exploit JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language (MVEL) expression. NOTE: some of these details are obtained from third party information.
CVE-2014-0111 Medium 2014-04-17 No exploit published No public exploit Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to Apache Commons JEXL expressions, "derived schema definition," "user / role templates," and "account links of resource mappings."
CVE-2013-6468 Medium 2014-04-10 No exploit published No public exploit JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.
CVE-2014-1202 High 2014-01-25 Mitigation candidate Working exploit published The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
CVE-2013-6366 Medium 2013-11-04 Protected by Waratek Working exploit published The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime().exec call.
CVE-2013-4330 Medium 2013-10-04 No exploit published No public exploit Apache Camel before 2.9.7, 2.10.0 before 2.10.7, 2.11.0 before 2.11.2, and 2.12.0 allows remote attackers to execute arbitrary simple language expressions by including "$simple{}" in a CamelFileName message header to a (1) FILE or (2) FTP producer.
CVE-2013-2035 Medium 2013-08-28 No exploit published No public exploit Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.
CVE-2013-2135 High 2013-07-16 No exploit published No public exploit Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
CVE-2013-2134 High 2013-07-16 Mitigation candidate Exploited Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
CVE-2013-1777 High 2013-07-11 No exploit published No public exploit The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1, as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products, does not properly implement the RMI classloader, which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.
CVE-2013-2115 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
CVE-2013-1966 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
CVE-2013-1965 High 2013-07-10 Protected by Waratek Exploited Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
CVE-2011-2732 Medium 2012-12-05 Mitigation candidate Working exploit published CRLF injection vulnerability in the logout functionality in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the spring-security-redirect parameter.
CVE-2012-0391 Critical 2012-01-08 Protected by Waratek Exploited The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
CVE-2010-1622 Medium 2010-06-21 Protected by Waratek Working exploit published SpringSource Spring Framework 2.5.x before 2.5.6.SEC02, 2.5.7 before 2.5.7.SR01, and 3.0.x before 3.0.3 allows remote attackers to execute arbitrary code via an HTTP request containing class.classLoader.URLs[0]=jar: followed by a URL of a crafted .jar file.
CVE-2009-3865 High 2009-11-05 No exploit published No public exploit The launch method in the Deployment Toolkit plugin in Java Runtime Environment (JRE) in Sun Java SE in JDK and JRE 6 before Update 17 allows remote attackers to execute arbitrary commands via a crafted web page, aka Bug Id 6869752.
CVE-2009-1719 High 2009-06-16 No exploit published No public exploit The Aqua Look and Feel for Java implementation in Java 1.5 on Mac OS X 10.5 allows remote attackers to execute arbitrary code via a call to the undocumented apple.laf.CColourUIResource constructor with a crafted value in the first argument, which is dereferenced as a pointer.
CVE-2009-1102 Medium 2009-03-25 No exploit published No public exploit Unspecified vulnerability in the Virtual Machine in Java SE Development Kit (JDK) and Java Runtime Environment (JRE) 6 Update 12 and earlier allows remote attackers to access files and execute arbitrary code via unknown vectors related to "code generation."
CVE-2008-3440 High 2008-08-01 No exploit published No public exploit Sun Java 1.6.0_03 and earlier versions, and possibly later versions, does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.
CVE-2007-6382 Medium 2007-12-15 No exploit published No public exploit The Event Dispatch Thread in Robocode before 1.5.1 allows remote attackers to execute arbitrary Java code by using a robot to invoke the SwingUtilities.invokeLater method.
CVE-2007-5615 Medium 2007-12-05 No exploit published No public exploit CRLF injection vulnerability in Mortbay Jetty before 6.1.6rc0 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.
CVE-2007-5153 Medium 2007-10-01 No exploit published No public exploit Unspecified vulnerability in Sun Java System Access Manager 7.1, when installed in a Sun Java System Application Server 8.x container, allows remote attackers to execute arbitrary code via unspecified vectors.
‹ prev page 3 of 3 next ›