WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product max data✕
Overview 7 matches · 0 in Waratek scope · 0 protected · 2 exploited · 1 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
7matches 0in Waratek scope0.0% 0protected0.0% 2exploited28.6% 1CISA KEV14.3% 2public PoC28.6% 2EPSS ≥ 0.528.6%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 2 28.6% Not applicable 5 71.4% Withdrawn CVE 0 0.0%
Critical 4 57.1% High 1 14.3% Medium 2 28.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 28.6% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 71.4%
split by peak 3 / month
Not applicable: 5Outside Waratek scope: 2 Medium: 2High: 1Critical: 4 not blocked: 7 No public exploit: 5Exploited: 2
Apr 202 Outside Waratek scope2 Medium2 not blocked2 Exploited2 May 200 Jun 203 Not applicable3 Critical2 High1 not blocked3 No public exploit3 Jul 202 Not applicable2 Critical2 not blocked2 No public exploit2
Apr 20May 20Jun 20Jul 20
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-7699 Critical 2020-07-30 Not applicable No public exploit This affects the package express-fileupload before 1.1.8. If the parseNested option is enabled, sending a corrupt HTTP request can lead to denial of service or arbitrary code execution.
CVE-2020-15801 Critical 2020-07-17 Not applicable No public exploit In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.
CVE-2020-14968 Critical 2020-06-22 Not applicable No public exploit An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipulation/modification by prepending '\0' bytes to a signature (it accepts these modified signatures as valid). An attacker can abuse this behavior in an application by creating multiple valid signatures where only one signature should exist. Also, an attacker might prepend these bytes with the goal of triggering memory corruption issues.
CVE-2020-14967 Critical 2020-06-22 Not applicable No public exploit An issue was discovered in the jsrsasign package before 8.0.18 for Node.js. Its RSA PKCS1 v1.5 decryption implementation does not detect ciphertext modification by prepending '\0' bytes to ciphertexts (it decrypts modified ciphertexts without error). An attacker might prepend these bytes with the goal of triggering memory corruption issues.
CVE-2020-14966 High 2020-06-22 Not applicable No public exploit An issue was discovered in the jsrsasign package through 8.0.18 for Node.js. It allows a malleability in ECDSA signatures by not checking overflows in the length of a sequence and '0' characters appended or prepended to an integer. The modified signatures are verified as valid. This could have a security-relevant impact if an application relied on a single canonical signature.
CVE-2020-11023 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-11022 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.