Overview 54 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
54matches
1in Waratek scope1.9%
1protected1.9%
0exploited0.0%
0CISA KEV0.0%
2public PoC3.7%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
1.9%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
53
98.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
1.9%
partly blocked
0
0.0%
not blocked
53
98.1%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
3.7%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
52
96.3%
split by
peak 24 / quarter
Q3 121
Not applicable1
Medium1
not blocked1
No public exploit1
Q4 120
Q1 130
Q2 130
Q3 130
Q4 131
Not applicable1
Medium1
not blocked1
No public exploit1
Q1 149
Not applicable9
High1
Medium8
not blocked9
No public exploit9
Q2 143
Protected by Waratek1
Not applicable2
High1
Medium2
blocked by ARMR today1
not blocked2
Working exploit published1
No public exploit2
Q3 142
Not applicable2
Medium2
not blocked2
No public exploit2
Q4 140
Q1 150
Q2 150
Q3 150
Q4 151
Not applicable1
Low1
not blocked1
No public exploit1
Q1 160
Q2 160
Q3 160
Q4 160
Q1 1724
Not applicable24
Critical5
High7
Medium12
not blocked24
Working exploit published1
No public exploit23
Q2 175
Not applicable5
Critical1
High3
Medium1
not blocked5
No public exploit5
Q3 175
Not applicable5
High2
Medium3
not blocked5
No public exploit5
Q4 173
Not applicable3
High3
not blocked3
No public exploit3
Q4 12Q2 13Q4 13Q2 14Q4 14Q2 15Q4 15Q2 16Q4 16Q2 17Q4 17
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2017-17806 | High | 2017-12-20 | Not applicable | No public exploit | The HMAC implementation (crypto/hmac.c) in the Linux kernel before 4.14.8 does not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AF_ALG-based hash interface (CONFIG_CRYPTO_USER_API_HASH) and the SHA-3 hash algorithm (CONFIG_CRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization. |
| CVE-2017-17805 | High | 2017-12-20 | Not applicable | No public exploit | The Salsa20 encryption algorithm in the Linux kernel before 4.14.8 does not correctly handle zero-length inputs, allowing a local attacker able to use the AF_ALG-based skcipher interface (CONFIG_CRYPTO_USER_API_SKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipher_walk API. Both the generic implementation (crypto/salsa20_generic.c) and x86 implementation (arch/x86/crypto/salsa20_glue.c) of Salsa20 were vulnerable. |
| CVE-2016-1254 | High | 2017-12-05 | Not applicable | No public exploit | Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor. |
| CVE-2015-3138 | High | 2017-09-28 | Not applicable | No public exploit | print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash). |
| CVE-2014-4616 | Medium | 2017-08-24 | Not applicable | No public exploit | Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function. |
| CVE-2015-3405 | High | 2017-08-09 | Not applicable | No public exploit | ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys. |
| CVE-2015-5203 | Medium | 2017-08-02 | Not applicable | No public exploit | Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. |
| CVE-2015-5221 | Medium | 2017-07-25 | Not applicable | No public exploit | Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. |
| CVE-2016-9961 | Critical | 2017-06-06 | Not applicable | No public exploit | game-music-emu before 0.6.1 mishandles unspecified integer values. |
| CVE-2016-9960 | Medium | 2017-06-06 | Not applicable | No public exploit | game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash). |
| CVE-2016-9959 | High | 2017-04-12 | Not applicable | No public exploit | game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values. |
| CVE-2016-9958 | High | 2017-04-12 | Not applicable | No public exploit | game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations. |
| CVE-2016-9957 | High | 2017-04-12 | Not applicable | No public exploit | Stack-based buffer overflow in game-music-emu before 0.6.1. |
| CVE-2017-6542 | Critical | 2017-03-27 | Not applicable | Working exploit published | The ssh_agent_channel_data function in PuTTY before 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message and leveraging the ability to connect to the Unix-domain socket representing the forwarded agent connection, which trigger a buffer overflow. |
| CVE-2015-8010 | Medium | 2017-03-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi. |
| CVE-2016-7797 | High | 2017-03-24 | Not applicable | No public exploit | Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated connection. |
| CVE-2016-9556 | Medium | 2017-03-23 | Not applicable | No public exploit | The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file. |
| CVE-2016-10048 | High | 2017-03-23 | Not applicable | No public exploit | Directory traversal vulnerability in magick/module.c in ImageMagick 6.9.4-7 allows remote attackers to load arbitrary modules via unspecified vectors. |
| CVE-2014-9851 | High | 2017-03-20 | Not applicable | No public exploit | ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (application crash). |
| CVE-2014-9850 | High | 2017-03-20 | Not applicable | No public exploit | Logic error in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (resource consumption). |
| CVE-2014-9849 | High | 2017-03-20 | Not applicable | No public exploit | The png coder in ImageMagick allows remote attackers to cause a denial of service (crash). |
| CVE-2014-9848 | High | 2017-03-20 | Not applicable | No public exploit | Memory leak in ImageMagick allows remote attackers to cause a denial of service (memory consumption). |
| CVE-2014-9847 | Critical | 2017-03-20 | Not applicable | No public exploit | The jng decoder in ImageMagick 6.8.9.9 allows remote attackers to have an unspecified impact. |
| CVE-2014-9846 | Critical | 2017-03-20 | Not applicable | No public exploit | Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact. |
| CVE-2014-9845 | Medium | 2017-03-20 | Not applicable | No public exploit | The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file. |
| CVE-2014-9844 | Medium | 2017-03-20 | Not applicable | No public exploit | The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file. |
| CVE-2014-9843 | Critical | 2017-03-20 | Not applicable | No public exploit | The DecodePSDPixels function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors. |
| CVE-2014-9842 | High | 2017-03-20 | Not applicable | No public exploit | Memory leak in the ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (memory consumption) via unspecified vectors. |
| CVE-2014-9841 | Critical | 2017-03-20 | Not applicable | No public exploit | The ReadPSDLayers function in coders/psd.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to "throwing of exceptions." |
| CVE-2014-9853 | Medium | 2017-03-17 | Not applicable | No public exploit | Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file. |
| CVE-2017-5938 | Medium | 2017-03-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name. |
| CVE-2016-10069 | Medium | 2017-03-02 | Not applicable | No public exploit | coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames. |
| CVE-2016-10068 | Medium | 2017-03-02 | Not applicable | No public exploit | The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file. |
| CVE-2016-9436 | Medium | 2017-01-20 | Not applicable | No public exploit | parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to a <i> tag. |
| CVE-2016-9435 | Medium | 2017-01-20 | Not applicable | No public exploit | The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags. |
| CVE-2016-5317 | Medium | 2017-01-20 | Not applicable | No public exploit | Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file. |
| CVE-2016-5316 | Medium | 2017-01-20 | Not applicable | No public exploit | Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool. |
| CVE-2015-5218 | Low | 2015-11-09 | Not applicable | No public exploit | Buffer overflow in text-utils/colcrt.c in colcrt in util-linux before 2.27 allows local users to cause a denial of service (crash) via a crafted file, related to the page global variable. |
| CVE-2014-0481 | Medium | 2014-08-26 | Not applicable | No public exploit | The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name. |
| CVE-2014-4258 | Medium | 2014-07-17 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC. |
| CVE-2014-3004 | Medium | 2014-06-11 | Protected by Waratek | Working exploit published | The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document. |
| CVE-2014-1542 | Medium | 2014-06-11 | Not applicable | No public exploit | Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate. |
| CVE-2014-1528 | High | 2014-04-30 | Not applicable | No public exploit | The sse2_composite_src_x888_8888 function in Pixman, as used in Cairo in Mozilla Firefox 28.0 and SeaMonkey 2.25 on Windows, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write and application crash) by painting on a CANVAS element. |
| CVE-2014-1502 | Medium | 2014-03-19 | Not applicable | No public exploit | The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and render content in a different domain via unspecified vectors. |
| CVE-2014-1500 | Medium | 2014-03-19 | Not applicable | No public exploit | Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbeforeunload events that trigger background JavaScript execution. |
| CVE-2014-1499 | Medium | 2014-03-19 | Not applicable | No public exploit | Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission prompt by triggering navigation at a certain time during generation of this prompt. |
| CVE-2014-1498 | Medium | 2014-03-19 | Not applicable | No public exploit | The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm. |
| CVE-2014-1494 | High | 2014-03-19 | Not applicable | No public exploit | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (memory corruption and application crash) or possibly execute arbitrary code via unknown vectors. |
| CVE-2014-0081 | Medium | 2014-02-20 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. |
| CVE-2011-4093 | Medium | 2014-02-10 | Not applicable | No public exploit | Integer overflow in inc/server.hpp in libnet6 (aka net6) before 1.3.14 might allow remote attackers to hijack connections and gain privileges as other users by making a large number of connections until the overflow occurs and an ID of another user is provided. |
| CVE-2014-1489 | Medium | 2014-02-06 | Not applicable | No public exploit | Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted remote attackers to cause a denial of service (session restore) via a crafted web site. |
| CVE-2014-1484 | Medium | 2014-02-06 | Not applicable | No public exploit | Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application. |
| CVE-2013-5611 | Medium | 2013-12-11 | Not applicable | No public exploit | Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App installation site by controlling the timing of page navigation. |
| CVE-2012-0867 | Medium | 2012-07-18 | Not applicable | No public exploit | PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters. |