WaratekVRT Sign in
Reset
More filters (1)
Columns
Product spring data rest✕
Overview 3 matches · 2 exploited · 1 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
3matches 2exploited66.7% 1CISA KEV33.3% 2public PoC66.7% 2EPSS ≥ 0.566.7%
Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 66.7% High 1 33.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 66.7% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 1 33.3%
split by peak 1 / month
Protected by Waratek: 3 High: 1Critical: 2 blocked by ARMR today: 3 No public exploit: 1Exploited: 2
Jan 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Feb 180 Mar 180 Apr 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 May 181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Jan 18Feb 18Mar 18Apr 18May 18
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2018-1259 High 2018-05-11 Protected by Waratek No public exploit Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
CVE-2018-1273 Critical 2018-04-11 Protected by Waratek Exploited Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVE-2017-8046 Critical 2018-01-04 Protected by Waratek Exploited Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.