WaratekVRT Sign in

Critical Stream Analytics CVEs

6 CVEs, 4 protected by Waratek

Reset
More filters (1)
Columns
Product stream analytics✕
Overview 6 matches · 4 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
6matches 4protected66.7% 0exploited0.0% 0CISA KEV0.0% 1public PoC16.7% 0EPSS ≥ 0.50.0%
Protected by Waratek 4 66.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 33.3%
Critical 6 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 66.7% partly blocked 0 0.0% not blocked 2 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 5 83.3%
split by peak 3 / quarter
No exploit published: 2Protected by Waratek: 4 Critical: 6 not blocked: 2blocked by ARMR today: 4 No public exploit: 5Proof of concept only: 1
Q1 181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 193 Protected by Waratek3 Critical3 blocked by ARMR today3 Proof of concept only1 No public exploit2 Q4 190 Q1 202 No exploit published2 Critical2 not blocked2 No public exploit2
Q1 18Q2 18Q3 18Q4 18Q1 19Q2 19Q3 19Q4 19Q1 20
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-14893 Critical 2020-03-02 No exploit published No public exploit A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
CVE-2019-20330 Critical 2020-01-03 No exploit published No public exploit FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2019-16335 Critical 2019-09-15 Protected by Waratek No public exploit A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVE-2019-14540 Critical 2019-09-15 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-14379 Critical 2019-07-29 Protected by Waratek No public exploit SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVE-2018-8088 Critical 2018-03-20 Protected by Waratek No public exploit org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.