WaratekVRT Sign in

Vcenter Server CVEs

9 CVEs, 1 exploited, 3 protected by Waratek

Reset
More filters (1)
Columns
Product vcenter server✕
Overview 9 matches · 3 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 3 EPSS ≥ 0.5
9matches 3protected33.3% 1exploited11.1% 0CISA KEV0.0% 2public PoC22.2% 3EPSS ≥ 0.533.3%
Protected by Waratek 3 33.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 6 66.7%
Critical 1 11.1% High 1 11.1% Medium 4 44.4% Low 3 33.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 33.3% partly blocked 0 0.0% not blocked 6 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 11.1% Working exploit published 1 11.1% Proof of concept only 0 0.0% Forecast only 1 11.1% No public exploit 6 66.7%
split by peak 6 / year
No exploit published: 6Protected by Waratek: 3 Low: 3Medium: 4High: 1Critical: 1 not blocked: 6blocked by ARMR today: 3 No public exploit: 6Forecast only: 1Working exploit published: 1Exploited: 1
20141 No exploit published1 Medium1 not blocked1 No public exploit1 20150 20160 20170 20180 20190 20200 20216 Protected by Waratek3 No exploit published3 Critical1 Medium3 Low2 blocked by ARMR today3 not blocked3 Exploited1 Working exploit published1 Forecast only1 No public exploit3 20222 No exploit published2 High1 Low1 not blocked2 No public exploit2
201420152016201720182019202020212022
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-2048 High 2022-07-07 No exploit published No public exploit In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.
CVE-2022-2047 Low 2022-07-07 No exploit published No public exploit In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
CVE-2021-34429 Medium 2021-07-15 Protected by Waratek Exploited For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
CVE-2021-34428 Low 2021-06-22 No exploit published No public exploit For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
CVE-2021-28164 Medium 2021-04-01 Protected by Waratek Working exploit published In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVE-2021-28163 Low 2021-04-01 No exploit published No public exploit In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
CVE-2021-26987 Critical 2021-03-15 Protected by Waratek No public exploit Element Plug-in for vCenter Server incorporates SpringBoot Framework. SpringBoot Framework versions prior to 1.3.2 are susceptible to a vulnerability which when successfully exploited could lead to Remote Code Execution. All versions of Element Plug-in for vCenter Server, Management Services versions prior to 2.17.56 and Management Node versions through 12.2 contain vulnerable versions of SpringBoot Framework.
CVE-2020-27223 Medium 2021-02-26 No exploit published Forecast only In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
CVE-2014-4241 Medium 2014-07-17 No exploit published No public exploit Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.0.2.0 and 10.3.6.0 allows remote attackers to affect integrity via vectors related to WLS - Web Services.