VRT Sign in

Extensions CVEs

2 CVEs, 1 protected by Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

2matches 1protected50.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 1 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 50.0%

Critical 0 0.0% High 2 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 50.0% partly blocked 0 0.0% not blocked 1 50.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 50.0% Forecast only 0 0.0% No public exploit 1 50.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Dec 231 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Jan 240 Feb 240 Mar 240 Apr 240 May 240 Jun 240 Jul 240 Aug 240 Sep 240 Oct 241 No exploit published1 High1 not blocked1 Proof of concept only1

Dec 23Jan 24Feb 24Mar 24Apr 24May 24Jun 24Jul 24Aug 24Sep 24Oct 24

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2024-47878	High	2024-10-24	No exploit published	Proof of concept only	OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Version 3.8.3 fixes this issue.
CVE-2023-6836	High	2023-12-15	Protected by Waratek	No public exploit	Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2024-47878

High

2024-10-24

No exploit published

Proof of concept only

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the `/extension/gdata/authorized` endpoint includes the `state` GET parameter verbatim in a `<script>` tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing JavaScript code, which would then cause that code to be executed in the victim's browser as if it was part of OpenRefine. Version 3.8.3 fixes this issue.

CVE-2023-6836

High

2023-12-15

Protected by Waratek

No public exploit

Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.