WaratekVRT Sign in
Reset
More filters (2)
Columns
Product banking platform✕Has a public PoC✕
Overview 11 matches · 8 protected · 3 exploited · 0 CISA KEV · 4 EPSS ≥ 0.5
11matches 8protected72.7% 3exploited27.3% 0CISA KEV0.0% 4EPSS ≥ 0.536.4%
Protected by Waratek 8 72.7% Rule in development 0 0.0% Mitigation candidate 3 27.3% No exploit published 0 0.0%
Critical 6 54.5% High 3 27.3% Medium 2 18.2% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 8 72.7% partly blocked 0 0.0% not blocked 3 27.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 27.3% Working exploit published 4 36.4% Proof of concept only 4 36.4% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / quarter
Mitigation candidate: 3Protected by Waratek: 8 Medium: 2High: 3Critical: 6 not blocked: 3blocked by ARMR today: 8 Proof of concept only: 4Working exploit published: 4Exploited: 3
Q2 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 Q3 170 Q4 170 Q1 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 192 Protected by Waratek2 Critical1 High1 blocked by ARMR today2 Proof of concept only2 Q4 190 Q1 203 Mitigation candidate3 Critical2 High1 not blocked3 Exploited2 Proof of concept only1 Q2 200 Q3 200 Q4 201 Protected by Waratek1 High1 blocked by ARMR today1 Working exploit published1 Q1 211 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 Q2 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Q3 210 Q4 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1
Q2 17Q4 17Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-45105 Medium 2021-12-18 Protected by Waratek Exploited Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2020-6950 Medium 2021-06-02 Protected by Waratek Working exploit published Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVE-2021-21345 Critical 2021-03-23 Protected by Waratek Working exploit published XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CVE-2020-26217 High 2020-11-16 Protected by Waratek Working exploit published XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
CVE-2020-10673 High 2020-03-18 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVE-2020-9548 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2020-9547 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVE-2019-14540 Critical 2019-09-15 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-14439 High 2019-07-30 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2017-7525 Critical 2018-02-06 Protected by Waratek Proof of concept only A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.