WaratekVRT Sign in

Odata-client-core CVEs

3 CVEs, 1 exploited, 1 protected by Waratek

Reset
More filters (1)
Columns
Product odata-client-core✕
Overview 3 matches · 1 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
3matches 1protected33.3% 1exploited33.3% 0CISA KEV0.0% 1public PoC33.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 33.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 66.7%
Critical 0 0.0% High 2 66.7% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 33.3% partly blocked 0 0.0% not blocked 2 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 33.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 66.7%
split by peak 2 / month
No exploit published: 2Protected by Waratek: 1 Medium: 1High: 2 not blocked: 2blocked by ARMR today: 1 No public exploit: 2Exploited: 1
Dec 192 Protected by Waratek1 No exploit published1 High1 Medium1 blocked by ARMR today1 not blocked1 Exploited1 No public exploit1 Jan 201 No exploit published1 High1 not blocked1 No public exploit1
Dec 19Jan 20
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-1925 High 2020-01-09 No exploit published No public exploit Apache Olingo versions 4.0.0 to 4.7.0 provide the AsyncRequestWrapperImpl class which reads a URL from the Location header, and then sends a GET or DELETE request to this URL. It may allow to implement a SSRF attack. If an attacker tricks a client to connect to a malicious server, the server can make the client call any URL including internal resources which are not directly accessible by the attacker.
CVE-2019-17555 High 2019-12-04 No exploit published No public exploit The AsyncResponseWrapperImpl class in Apache Olingo versions 4.0.0 to 4.6.0 reads the Retry-After header and passes it to the Thread.sleep() method without any check. If a malicious server returns a huge value in the header, then it can help to implement a DoS attack.
CVE-2019-17554 Medium 2019-12-04 Protected by Waratek Exploited The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.