WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕Product openshift container platform✕
Overview 9 matches · 5 protected · 7 exploited · 4 CISA KEV
9matches 5protected55.6% 7exploited77.8% 4CISA KEV44.4%
Protected by Waratek 5 55.6% Rule in development 0 0.0% Mitigation candidate 4 44.4% No exploit published 0 0.0%
Critical 4 44.4% High 5 55.6% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 55.6% partly blocked 0 0.0% not blocked 4 44.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 7 77.8% Working exploit published 2 22.2% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 5 / year
Mitigation candidate: 4Protected by Waratek: 5 High: 5Critical: 4 not blocked: 4blocked by ARMR today: 5 Working exploit published: 2Exploited: 7
20151 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20160 20170 20181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20195 Protected by Waratek2 Mitigation candidate3 Critical2 High3 blocked by ARMR today2 not blocked3 Exploited4 Working exploit published1 20200 20211 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20220 20231 Mitigation candidate1 High1 not blocked1 Exploited1
201520162017201820192020202120222023
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2021-4104 High 2021-12-14 Protected by Waratek Exploited JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2019-1003030 Critical 2019-03-08 Protected by Waratek Exploited A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003029 Critical 2019-03-08 Protected by Waratek Exploited A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScript.java that allows attackers with Overall/Read permission to execute arbitrary code on the Jenkins master JVM.
CVE-2019-1003002 High 2019-01-22 Mitigation candidate Working exploit published A sandbox bypass vulnerability exists in Pipeline: Declarative Plugin 1.3.3 and earlier in pipeline-model-definition/src/main/groovy/org/jenkinsci/plugins/pipeline/modeldefinition/parser/Converter.groovy that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2019-1003001 High 2019-01-22 Mitigation candidate Exploited A sandbox bypass vulnerability exists in Pipeline: Groovy Plugin 2.61 and earlier in src/main/java/org/jenkinsci/plugins/workflow/cps/CpsFlowDefinition.java, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShellFactory.java that allows attackers with Overall/Read permission to provide a pipeline script to an HTTP endpoint that can result in arbitrary code execution on the Jenkins master JVM.
CVE-2019-1003000 High 2019-01-22 Mitigation candidate Exploited A sandbox bypass vulnerability exists in Script Security Plugin 1.49 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java that allows attackers with the ability to provide sandboxed scripts to execute arbitrary code on the Jenkins master JVM.
CVE-2018-1000861 Critical 2018-12-10 Protected by Waratek Exploited A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this way.
CVE-2015-8103 Critical 2015-11-25 Protected by Waratek Working exploit published The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the "Groovy variant in 'ysoserial'".