WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor com.alibaba✕
Overview 10 matches · 8 in Waratek scope · 3 protected · 3 exploited · 0 CISA KEV · 4 public PoC · 1 EPSS ≥ 0.5
10matches 8in Waratek scope80.0% 3protected30.0% 3exploited30.0% 0CISA KEV0.0% 4public PoC40.0% 1EPSS ≥ 0.510.0%
Protected by Waratek 3 30.0% Rule in development 0 0.0% Mitigation candidate 2 20.0% No exploit published 3 30.0% Outside Waratek scope 2 20.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 8 80.0% High 0 0.0% Medium 2 20.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 30.0% partly blocked 0 0.0% not blocked 7 70.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 30.0% Working exploit published 0 0.0% Proof of concept only 2 20.0% Forecast only 1 10.0% No public exploit 4 40.0%
split by peak 4 / year
Outside Waratek scope: 2No exploit published: 3Mitigation candidate: 2Protected by Waratek: 3 Medium: 2Critical: 8 not blocked: 7blocked by ARMR today: 3 No public exploit: 4Forecast only: 1Proof of concept only: 2Exploited: 3
20181 Outside Waratek scope1 Critical1 not blocked1 Exploited1 20190 20200 20214 Protected by Waratek1 Mitigation candidate1 No exploit published2 Critical3 Medium1 blocked by ARMR today1 not blocked3 Proof of concept only1 Forecast only1 No public exploit2 20223 Protected by Waratek1 Mitigation candidate1 No exploit published1 Critical2 Medium1 blocked by ARMR today1 not blocked2 Proof of concept only1 No public exploit2 20230 20240 20250 20262 Protected by Waratek1 Outside Waratek scope1 Critical2 blocked by ARMR today1 not blocked1 Exploited2
201820192020202120222023202420252026
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-16723 Critical 2026-07-23 Protected by Waratek Exploited A remote code execution (RCE) vulnerability exists in fastjson 1.2.68 through 1.2.83. This vulnerability is exploitable under fastjson's stock default configuration — no AutoType enablement required, no classpath gadget required.
CVE-2025-70974 Critical 2026-01-09 Outside Waratek scope Exploited Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
CVE-2022-39198 Critical 2022-10-18 Protected by Waratek No public exploit A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.17 and prior versions; Apache Dubbo 3.0.x version 3.0.11 and prior versions; Apache Dubbo 3.1.x version 3.1.0 and prior versions.
CVE-2022-25845 Critical 2022-06-10 Mitigation candidate Proof of concept only The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVE-2022-24969 Medium 2022-06-09 No exploit published No public exploit bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
CVE-2021-30181 Critical 2021-06-01 No exploit published Forecast only Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
CVE-2021-30179 Critical 2021-06-01 Protected by Waratek No public exploit Apache Dubbo prior to 2.6.9 and 2.7.9 by default supports generic calls to arbitrary methods exposed by provider interfaces. These invocations are handled by the GenericFilter which will find the service and method specified in the first arguments of the invocation and use the Java Reflection API to make the final call. The signature for the $invoke or $invokeAsync methods is Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object; where the first argument is the name of the method to invoke, the second one is an array with the parameter types for the method being invoked and the third one is an array with the actual call arguments. In addition, the caller also needs to set an RPC attachment specifying that the call is a generic call and how to decode the arguments. The possible values are: - true - raw.return - nativejava - bean - protobuf-json An attacker can control this RPC attachment and set it to nativejava to force the java deserialization of the byte array located in the third argument.
CVE-2021-25641 Critical 2021-06-01 Mitigation candidate Proof of concept only Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.
CVE-2021-25640 Medium 2021-06-01 No exploit published No public exploit In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
CVE-2017-18349 Critical 2018-10-23 Outside Waratek scope Exploited parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.