WaratekVRT Sign in

Communications Cloud Native Core Network Function Cloud Native Environment CVEs

8 CVEs, 4 exploited, 4 protected by Waratek

Reset
More filters (1)
Columns
Product communications cloud native core network function cloud native environment✕
Overview 8 matches · 4 protected · 4 exploited · 3 CISA KEV · 4 public PoC · 4 EPSS ≥ 0.5
8matches 4protected50.0% 4exploited50.0% 3CISA KEV37.5% 4public PoC50.0% 4EPSS ≥ 0.550.0%
Protected by Waratek 4 50.0% Rule in development 0 0.0% Mitigation candidate 1 12.5% No exploit published 3 37.5%
Critical 3 37.5% High 1 12.5% Medium 4 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 50.0% partly blocked 0 0.0% not blocked 4 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 4 50.0%
split by peak 2 / quarter
No exploit published: 3Mitigation candidate: 1Protected by Waratek: 4 Medium: 4High: 1Critical: 3 not blocked: 4blocked by ARMR today: 4 No public exploit: 4Exploited: 4
Q4 191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q1 200 Q2 200 Q3 202 No exploit published2 Medium2 not blocked2 No public exploit2 Q4 200 Q1 210 Q2 211 No exploit published1 High1 not blocked1 No public exploit1 Q3 210 Q4 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 Q1 221 Mitigation candidate1 Critical1 not blocked1 Exploited1 Q2 222 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited2
Q4 19Q1 20Q2 20Q3 20Q4 20Q1 21Q2 21Q3 21Q4 21Q1 22Q2 22
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-22965 Critical 2022-04-01 Protected by Waratek Exploited A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22963 Critical 2022-04-01 Protected by Waratek Exploited In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2022-22947 Critical 2022-03-03 Mitigation candidate Exploited In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
CVE-2021-45105 Medium 2021-12-18 Protected by Waratek Exploited Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2021-33560 High 2021-06-08 No exploit published No public exploit Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.
CVE-2020-7017 Medium 2020-07-27 No exploit published No public exploit In Kibana versions before 6.8.11 and 7.8.1 the region map visualization in contains a stored XSS flaw. An attacker who is able to edit or create a region map visualization could obtain sensitive information or perform destructive actions on behalf of Kibana users who view the region map visualization.
CVE-2020-7016 Medium 2020-07-27 No exploit published No public exploit Kibana versions before 6.8.11 and 7.8.1 contain a denial of service (DoS) flaw in Timelion. An attacker can construct a URL that when viewed by a Kibana user can lead to the Kibana process consuming large amounts of CPU and becoming unresponsive.
CVE-2019-10219 Medium 2019-11-08 Protected by Waratek No public exploit A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.