Overview 26 matches · 4 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 0 EPSS ≥ 0.5
26matches
4in Waratek scope15.4%
1protected3.8%
0exploited0.0%
0CISA KEV0.0%
4public PoC15.4%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
3.8%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
3
11.5%
Outside Waratek scope
0
0.0%
Not applicable
22
84.6%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
3.8%
partly blocked
0
0.0%
not blocked
25
96.2%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
4
15.4%
Proof of concept only
1
3.8%
Forecast only
0
0.0%
No public exploit
21
80.8%
split by
peak 8 / year
20061
Not applicable1
High1
not blocked1
Working exploit published1
20070
20081
Not applicable1
High1
not blocked1
Working exploit published1
20092
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20100
20110
20120
20130
20140
20151
Not applicable1
Low1
not blocked1
No public exploit1
20160
20171
Not applicable1
High1
not blocked1
No public exploit1
20181
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
20191
Not applicable1
Critical1
not blocked1
No public exploit1
20208
No exploit published2
Not applicable6
Critical1
High2
Medium5
not blocked8
No public exploit8
20214
Not applicable4
Critical1
High2
Medium1
not blocked4
No public exploit4
20223
No exploit published1
Not applicable2
High2
Medium1
not blocked3
Proof of concept only1
No public exploit2
20231
Not applicable1
High1
not blocked1
No public exploit1
20241
Not applicable1
Medium1
not blocked1
No public exploit1
20250
20261
Not applicable1
Medium1
not blocked1
No public exploit1
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-9290 | Medium | 2026-01-23 | Not applicable | No public exploit | An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values. Exploitation requires advanced network positioning and allows an attacker to intercept adoption traffic and forge valid authentication through offline precomputation, potentially exposing sensitive information and compromising confidentiality. |
| CVE-2024-8741 | Medium | 2024-09-25 | Not applicable | No public exploit | The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2023-4296 | High | 2023-08-29 | Not applicable | No public exploit | If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device. |
| CVE-2022-44565 | Medium | 2022-12-23 | Not applicable | No public exploit | An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a malicious actor to retrieve status and usage data from the UISP device. |
| CVE-2022-23496 | High | 2022-12-08 | No exploit published | No public exploit | Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. If uncaught the exception will result in a program crash. Applications that do not use this feature are not affected. Users are advised to upgrade to version 7.9.0. Users unable to upgrade may catch and discard any ArrayIndexOutOfBoundsException thrown by the Yauaa library. |
| CVE-2022-23639 | High | 2022-02-15 | Not applicable | Proof of concept only | crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`. This can cause unaligned memory accesses and data race. Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue. 32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are currently no known workarounds. |
| CVE-2021-32810 | Critical | 2021-08-02 | Not applicable | No public exploit | crossbeam-deque is a package of work-stealing deques for building task schedulers when programming in Rust. In versions prior to 0.7.4 and 0.8.0, the result of the race condition is that one or more tasks in the worker queue can be popped twice instead of other tasks that are forgotten and never popped. If tasks are allocated on the heap, this can cause double free and a memory leak. If not, this still can cause a logical bug. Crates using `Stealer::steal`, `Stealer::steal_batch`, or `Stealer::steal_batch_and_pop` are affected by this issue. This has been fixed in crossbeam-deque 0.8.1 and 0.7.4. |
| CVE-2020-26517 | Medium | 2021-06-08 | Not applicable | No public exploit | A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. It is possible to perform XSS attacks through using the WebDAV functionality to upload files to a project (Authn users), using the users import functionality (Admin only), and changing the login text in the application configuration (Admin only). |
| CVE-2020-26516 | High | 2021-06-08 | Not applicable | No public exploit | A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and can therefore be entirely predicted allowing attackers to cause the victim's browser to execute undesired actions in the web application through crafted requests. |
| CVE-2020-26515 | High | 2021-06-08 | Not applicable | No public exploit | An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the application contains the encrypted user's credentials. However, due to a bug in the application code, those credentials are encrypted using a NULL encryption key. |
| CVE-2020-35904 | Medium | 2020-12-31 | Not applicable | No public exploit | An issue was discovered in the crossbeam-channel crate before 0.4.4 for Rust. It has incorrect expectations about the relationship between the memory allocation and how many iterator elements there are. |
| CVE-2020-26513 | Medium | 2020-12-07 | Not applicable | No public exploit | An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML External Entity Attacks. |
| CVE-2020-27216 | High | 2020-10-23 | No exploit published | No public exploit | In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability. |
| CVE-2020-15254 | Critical | 2020-10-16 | Not applicable | No public exploit | Crossbeam is a set of tools for concurrent programming. In crossbeam-channel before version 0.4.4, the bounded channel incorrectly assumes that `Vec::from_iter` has allocated capacity that same as the number of iterator elements. `Vec::from_iter` does not actually guarantee that and may allocate extra memory. The destructor of the `bounded` channel reconstructs `Vec` from the raw pointer based on the incorrect assumes described above. This is unsound and causing deallocation with the incorrect capacity when `Vec::from_iter` has allocated different sizes with the number of iterator elements. This has been fixed in crossbeam-channel 0.4.4. |
| CVE-2019-20635 | Medium | 2020-04-02 | Not applicable | No public exploit | codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields. |
| CVE-2019-19913 | Medium | 2020-03-30 | Not applicable | No public exploit | In Intland codeBeamer ALM 9.5 and earlier, there is stored XSS via the Trackers Title parameter. |
| CVE-2019-19912 | Medium | 2020-03-30 | Not applicable | No public exploit | In Intland codeBeamer ALM 9.5 and earlier, a cross-site scripting (XSS) vulnerability in the Upload Flash File feature allows authenticated remote attackers to inject arbitrary scripts via an active script embedded in an SWF file. |
| CVE-2020-1929 | High | 2020-01-15 | No exploit published | No public exploit | The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM. |
| CVE-2018-20996 | Critical | 2019-08-26 | Not applicable | No public exploit | An issue was discovered in the crossbeam crate before 0.4.1 for Rust. There is a double free because of destructor mishandling. |
| CVE-2018-1259 | High | 2018-05-11 | Protected by Waratek | No public exploit | Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system. |
| CVE-2017-17763 | High | 2017-12-19 | Not applicable | No public exploit | SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection. |
| CVE-2015-4033 | Low | 2015-07-06 | Not applicable | No public exploit | Samsung SBeam allows remote attackers to read arbitrary images by leveraging an NFC connection to access the HTTP server on port 15000. |
| CVE-2009-0378 | Medium | 2009-02-02 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.php in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the pet parameter in a sign action. |
| CVE-2009-0377 | High | 2009-02-02 | Not applicable | Working exploit published | SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mpid parameter in a sign action to index.php, a different vector than CVE-2008-3132. |
| CVE-2008-3132 | High | 2008-07-10 | Not applicable | Working exploit published | SQL injection vulnerability in the beamospetition (com_beamospetition) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pet parameter to index.php. |
| CVE-2006-0359 | High | 2006-01-22 | Not applicable | Working exploit published | Buffer overflow in CounterPath eyeBeam SIP Softphone allows remote attackers to (1) cause a denial of service (device crash) via SIP INVITE commands with a long header field name sent during startup and (2) cause a denial of service (device hang or crash) via SIP INVITE commands with a long header field name sent during a call. |