WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Policy Automation✕
Overview 15 matches · 8 in Waratek scope · 3 protected · 4 exploited · 0 CISA KEV · 7 public PoC · 6 EPSS ≥ 0.5
15matches 8in Waratek scope53.3% 3protected20.0% 4exploited26.7% 0CISA KEV0.0% 7public PoC46.7% 6EPSS ≥ 0.540.0%
Protected by Waratek 3 20.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 33.3% Outside Waratek scope 6 40.0% Not applicable 1 6.7% Withdrawn CVE 0 0.0%
Critical 3 20.0% High 6 40.0% Medium 5 33.3% Low 1 6.7% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 20.0% partly blocked 0 0.0% not blocked 12 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 26.7% Working exploit published 2 13.3% Proof of concept only 4 26.7% Forecast only 0 0.0% No public exploit 5 33.3%
split by peak 3 / year
Not applicable: 1Outside Waratek scope: 6No exploit published: 5Protected by Waratek: 3 Low: 1Medium: 5High: 6Critical: 3 not blocked: 12blocked by ARMR today: 3 No public exploit: 5Proof of concept only: 4Working exploit published: 2Exploited: 4
20161 No exploit published1 High1 not blocked1 No public exploit1 20172 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited1 Working exploit published1 20180 20193 Outside Waratek scope3 Critical1 High1 Medium1 not blocked3 Exploited1 Working exploit published1 Proof of concept only1 20202 Outside Waratek scope2 Medium1 Low1 not blocked2 Exploited1 No public exploit1 20213 Protected by Waratek1 No exploit published1 Outside Waratek scope1 High1 Medium2 blocked by ARMR today1 not blocked2 Exploited1 Proof of concept only1 No public exploit1 20220 20232 No exploit published2 High2 not blocked2 Proof of concept only1 No public exploit1 20241 No exploit published1 Medium1 not blocked1 No public exploit1 20251 Not applicable1 High1 not blocked1 Proof of concept only1
2016201720182019202020212022202320242025
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-57699 High 2025-02-05 Not applicable Proof of concept only A security issue was found in Netplex Json-smart 2.5.0 through 2.5.1. When loading a specially crafted JSON input, containing a large number of ’{’, a stack exhaustion can be trigger, which could allow an attacker to cause a Denial of Service (DoS). This issue exists because of an incomplete fix for CVE-2023-1370.
CVE-2024-47554 Medium 2024-10-03 No exploit published No public exploit Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before 2.14.0. Users are recommended to upgrade to version 2.14.0 or later, which fixes the issue.
CVE-2023-1370 High 2023-03-22 No exploit published Proof of concept only [Json-smart](https://netplex.github.io/json-smart/) is a performance focused, JSON processor lib. When reaching a ‘[‘ or ‘{‘ character in the JSON input, the code parses an array or an object respectively. It was discovered that the code does not have any limit to the nesting of such arrays or objects. Since the parsing of nested arrays and objects is done recursively, nesting too many of them can cause a stack exhaustion (stack overflow) and crash the software.
CVE-2023-24998 High 2023-02-20 No exploit published No public exploit Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. Note that, like all of the file upload limits, the new configuration option (FileUploadBase#setFileCountMax) is not enabled by default and must be explicitly configured.
CVE-2021-44832 Medium 2021-12-28 Protected by Waratek Exploited Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVE-2021-41184 Medium 2021-10-26 Outside Waratek scope Proof of concept only jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
CVE-2021-2351 High 2021-07-21 No exploit published No public exploit Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1 and 19c. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Advanced Networking Option. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Advanced Networking Option, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Advanced Networking Option. Note: The July 2021 Critical Patch Update introduces a number of Native Network Encryption changes to deal with vulnerability CVE-2021-2351 and prevent the use of weaker ciphers. Customers should review: "Changes in Native Network Encryption with the July 2021 Critical Patch Update" (Doc ID 2791571.1). CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVE-2020-11022 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-9488 Low 2020-04-27 Outside Waratek scope No public exploit Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender. Fixed in Apache Log4j 2.12.3 and 2.13.1
CVE-2019-17195 Critical 2019-10-15 Outside Waratek scope Proof of concept only Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
CVE-2019-0227 High 2019-05-01 Outside Waratek scope Working exploit published A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue.
CVE-2019-11358 Medium 2019-04-20 Outside Waratek scope Exploited jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVE-2015-7501 Critical 2017-11-09 Protected by Waratek Exploited Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2016-3092 High 2016-07-04 No exploit published No public exploit The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.