WaratekVRT Sign in

Management Services For Element Software CVEs

12 CVEs, 1 exploited, 5 protected by Waratek

Reset
More filters (1)
Columns
Product management services for element software✕
Overview 12 matches · 5 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
12matches 5protected41.7% 1exploited8.3% 0CISA KEV0.0% 1public PoC8.3% 2EPSS ≥ 0.516.7%
Protected by Waratek 5 41.7% Rule in development 0 0.0% Mitigation candidate 1 8.3% No exploit published 6 50.0%
Critical 1 8.3% High 5 41.7% Medium 5 41.7% Low 1 8.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 41.7% partly blocked 0 0.0% not blocked 7 58.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 8.3% Working exploit published 0 0.0% Proof of concept only 1 8.3% Forecast only 1 8.3% No public exploit 9 75.0%
split by peak 3 / quarter
No exploit published: 6Mitigation candidate: 1Protected by Waratek: 5 Low: 1Medium: 5High: 5Critical: 1 not blocked: 7blocked by ARMR today: 5 No public exploit: 9Forecast only: 1Proof of concept only: 1Exploited: 1
Q4 191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q1 200 Q2 200 Q3 200 Q4 200 Q1 212 Protected by Waratek1 No exploit published1 Critical1 Medium1 blocked by ARMR today1 not blocked1 Forecast only1 No public exploit1 Q2 212 Protected by Waratek1 Mitigation candidate1 High1 Medium1 blocked by ARMR today1 not blocked1 Exploited1 No public exploit1 Q3 212 No exploit published2 High2 not blocked2 No public exploit2 Q4 212 Protected by Waratek1 No exploit published1 High1 Medium1 blocked by ARMR today1 not blocked1 No public exploit2 Q1 220 Q2 220 Q3 223 Protected by Waratek1 No exploit published2 High1 Medium1 Low1 blocked by ARMR today1 not blocked2 Proof of concept only1 No public exploit2
Q4 19Q1 20Q2 20Q3 20Q4 20Q1 21Q2 21Q3 21Q4 21Q1 22Q2 22Q3 22
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-36033 Medium 2022-08-29 Protected by Waratek Proof of concept only jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including `javascript:` URLs that have been crafted with control characters will not be sanitized. If the site that this HTML is published on does not set a Content Security Policy, an XSS attack is then possible. This issue is patched in jsoup 1.15.3. Users should upgrade to this version. Additionally, as the unsanitized input may have been persisted, old content should be cleaned again using the updated version. To remediate this issue without immediately upgrading: - disable `SafeList.preserveRelativeLinks`, which will rewrite input URLs as absolute URLs - ensure an appropriate [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is defined. (This should be used regardless of upgrading, as a defence-in-depth best practice.)
CVE-2022-2048 High 2022-07-07 No exploit published No public exploit In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.
CVE-2022-2047 Low 2022-07-07 No exploit published No public exploit In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
CVE-2021-22096 Medium 2021-10-28 No exploit published No public exploit In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.
CVE-2021-42340 High 2021-10-14 Protected by Waratek No public exploit The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. The object introduced to collect metrics for HTTP upgrade connections was not released for WebSocket connections once the connection was closed. This created a memory leak that, over time, could lead to a denial of service via an OutOfMemoryError.
CVE-2021-41079 High 2021-09-16 No exploit published No public exploit Apache Tomcat 8.5.0 to 8.5.63, 9.0.0-M1 to 9.0.43 and 10.0.0-M1 to 10.0.2 did not properly validate incoming TLS packets. When Tomcat was configured to use NIO+OpenSSL or NIO2+OpenSSL for TLS, a specially crafted packet could be used to trigger an infinite loop resulting in a denial of service.
CVE-2021-37714 High 2021-08-18 No exploit published No public exploit jsoup is a Java library for working with HTML. Those using jsoup versions prior to 1.14.2 to parse untrusted HTML or XML may be vulnerable to DOS attacks. If the parser is run on user supplied input, an attacker may supply content that causes the parser to get stuck (loop indefinitely until cancelled), to complete more slowly than usual, or to throw an unexpected exception. This effect may support a denial of service attack. The issue is patched in version 1.14.2. There are a few available workarounds. Users may rate limit input parsing, limit the size of inputs based on system resources, and/or implement thread watchdogs to cap and timeout parse runtimes.
CVE-2021-28169 Medium 2021-06-09 Mitigation candidate Exploited For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVE-2021-22118 High 2021-05-27 Protected by Waratek No public exploit In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
CVE-2021-26987 Critical 2021-03-15 Protected by Waratek No public exploit Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.
CVE-2020-27223 Medium 2021-02-26 No exploit published Forecast only In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
CVE-2019-10219 Medium 2019-11-08 Protected by Waratek No public exploit A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.