WaratekVRT Sign in
Reset
More filters (1)
Columns
Product poi✕
Overview 11 matches · 0 protected · 3 exploited · 0 CISA KEV · 10 public PoC · 1 EPSS ≥ 0.5
11matches 0protected0.0% 3exploited27.3% 0CISA KEV0.0% 10public PoC90.9% 1EPSS ≥ 0.59.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 11 100.0% No exploit published 0 0.0%
Critical 3 27.3% High 8 72.7% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 27.3% Working exploit published 3 27.3% Proof of concept only 4 36.4% Forecast only 0 0.0% No public exploit 1 9.1%
split by peak 4 / month
Mitigation candidate: 11 High: 8Critical: 3 not blocked: 11 No public exploit: 1Proof of concept only: 4Working exploit published: 3Exploited: 3
Mar 204 Mitigation candidate4 Critical3 High1 not blocked4 Exploited2 Proof of concept only1 No public exploit1 Apr 200 May 200 Jun 200 Jul 200 Aug 200 Sep 200 Oct 200 Nov 200 Dec 201 Mitigation candidate1 High1 not blocked1 Proof of concept only1 Jan 212 Mitigation candidate2 High2 not blocked2 Proof of concept only2 Feb 210 Mar 210 Apr 210 May 211 Mitigation candidate1 High1 not blocked1 Working exploit published1 Jun 210 Jul 210 Aug 213 Mitigation candidate3 High3 not blocked3 Exploited1 Working exploit published2
Apr 20Jun 20Aug 20Oct 20Dec 20Feb 21Apr 21Jun 21Aug 21
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-39152 High 2021-08-23 Mitigation candidate Exploited XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the [Security Framework](https://x-stream.github.io/security.html#framework), you will have to use at least version 1.4.18.
CVE-2021-39146 High 2021-08-23 Mitigation candidate Working exploit published XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVE-2021-39141 High 2021-08-23 Mitigation candidate Working exploit published XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVE-2021-29505 High 2021-05-28 Mitigation candidate Working exploit published XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
CVE-2020-36179 High 2021-01-07 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
CVE-2020-36184 High 2021-01-06 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
CVE-2020-35728 High 2020-12-27 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
CVE-2020-10673 High 2020-03-18 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVE-2020-9548 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2020-9547 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVE-2020-9546 Critical 2020-03-02 Mitigation candidate No public exploit FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).