WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor snowsoftware✕
Overview 11 matches · 1 in Waratek scope · 1 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
11matches 1in Waratek scope9.1% 1protected9.1% 1exploited9.1% 1CISA KEV9.1% 1public PoC9.1% 1EPSS ≥ 0.59.1%
Protected by Waratek 1 9.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 10 90.9% Withdrawn CVE 0 0.0%
Critical 1 9.1% High 6 54.5% Medium 4 36.4% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 9.1% partly blocked 0 0.0% not blocked 10 90.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 9.1% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 10 90.9%
split by peak 3 / quarter
Not applicable: 10Protected by Waratek: 1 Medium: 4High: 6Critical: 1 not blocked: 10blocked by ARMR today: 1 No public exploit: 10Exploited: 1
Q1 211 Not applicable1 High1 not blocked1 No public exploit1 Q2 210 Q3 210 Q4 212 Protected by Waratek1 Not applicable1 Critical1 Medium1 blocked by ARMR today1 not blocked1 Exploited1 No public exploit1 Q1 221 Not applicable1 High1 not blocked1 No public exploit1 Q2 221 Not applicable1 High1 not blocked1 No public exploit1 Q3 220 Q4 220 Q1 230 Q2 231 Not applicable1 Medium1 not blocked1 No public exploit1 Q3 232 Not applicable2 High1 Medium1 not blocked2 No public exploit2 Q4 230 Q1 243 Not applicable3 High2 Medium1 not blocked3 No public exploit3
Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23Q1 24
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-1150 High 2024-02-08 Not applicable No public exploit Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1.
CVE-2024-1149 High 2024-02-08 Not applicable No public exploit Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0; Inventory Agent: through 6.14.5; Inventory Agent: through 6.7.2.
CVE-2023-7169 Medium 2024-02-08 Not applicable No public exploit Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent: through 6.14.5. Customers advised to upgrade to version 7.0
CVE-2023-3937 Medium 2023-08-11 Not applicable No public exploit Cross site scripting vulnerability in web portal in Snow Software License Manager from version 9.0.0 up to and including 9.30.1 on Windows allows an authenticated user with high privileges to trigger cross site scripting attack via the web browser
CVE-2023-3864 High 2023-08-11 Not applicable No public exploit Blind SQL injection in a service running in Snow Software license manager from version 8.0.0 up to and including 9.30.1 on Windows allows a logged in user with high privileges to inject SQL commands via the web portal.
CVE-2023-2679 Medium 2023-05-17 Not applicable No public exploit Data leakage in Adobe connector in Snow Software SPE 9.27.0 on Windows allows privileged user to observe other users data.
CVE-2022-0883 High 2022-05-18 Not applicable No public exploit SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched.
CVE-2021-4106 High 2022-02-16 Not applicable No public exploit A vulnerability in Snow Inventory Java Scanner allows an attacker to run malicious code at a higher level of privileges. This issue affects: SNOW Snow Inventory Java Scanner 1.0
CVE-2021-44228 Critical 2021-12-10 Protected by Waratek Exploited Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2021-41562 Medium 2021-11-03 Not applicable No public exploit A vulnerability in Snow Snow Agent for Windows allows a non-admin user to cause arbitrary deletion of files. This issue affects: Snow Snow Agent for Windows version 5.0.0 to 6.7.1 on Windows.
CVE-2021-27579 High 2021-02-23 Not applicable No public exploit Snow Inventory Agent through 6.7.0 on Windows uses CPUID to report on processor types and versions that may be deployed and in use across an IT environment. A privilege-escalation vulnerability exists if CPUID is enabled, and thus it should be disabled via configuration settings.