WaratekVRT Sign in

Exploited Vmware CVEs

8 CVEs, 5 protected by Waratek

Reset
More filters (1)
Columns
Vendor vmware✕
Overview 8 matches · 5 protected · 5 CISA KEV · 6 EPSS ≥ 0.5
8matches 5protected62.5% 5CISA KEV62.5% 6EPSS ≥ 0.575.0%
Protected by Waratek 5 62.5% Rule in development 0 0.0% Mitigation candidate 3 37.5% No exploit published 0 0.0%
Critical 5 62.5% High 2 25.0% Medium 1 12.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 62.5% partly blocked 0 0.0% not blocked 3 37.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 8 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Mitigation candidate: 3Protected by Waratek: 5 Medium: 1High: 2Critical: 5 not blocked: 3blocked by ARMR today: 5 Exploited: 8
Q1 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q2 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 201 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q3 201 Mitigation candidate1 Medium1 not blocked1 Exploited1 Q4 200 Q1 210 Q2 210 Q3 210 Q4 211 Mitigation candidate1 High1 not blocked1 Exploited1 Q1 221 Mitigation candidate1 Critical1 not blocked1 Exploited1 Q2 222 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited2
Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-22965 Critical 2022-04-01 Protected by Waratek Exploited A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22963 Critical 2022-04-01 Protected by Waratek Exploited In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2022-22947 Critical 2022-03-03 Mitigation candidate Exploited In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
CVE-2021-22053 High 2021-11-19 Mitigation candidate Exploited Applications using both `spring-cloud-netflix-hystrix-dashboard` and `spring-boot-starter-thymeleaf` expose a way to execute code submitted within the request URI path during the resolution of view templates. When a request is made at `/hystrix/monitor;[user-provided data]`, the path elements following `hystrix/monitor` are being evaluated as SpringEL expressions, which can lead to code execution.
CVE-2020-5412 Medium 2020-08-07 Mitigation candidate Exploited Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.
CVE-2020-5410 High 2020-06-02 Protected by Waratek Exploited Spring Cloud Config, versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack.
CVE-2018-1273 Critical 2018-04-11 Protected by Waratek Exploited Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVE-2017-8046 Critical 2018-01-04 Protected by Waratek Exploited Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.