VRT Sign in

High Dromara CVEs

2 CVEs, 1 protected by Waratek

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

2matches 1protected50.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 1 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 50.0%

Critical 0 0.0% High 2 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 50.0% partly blocked 0 0.0% not blocked 1 50.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 2 100.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Jun 231 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 Jul 230 Aug 230 Sep 230 Oct 231 No exploit published1 High1 not blocked1 Proof of concept only1

Jun 23Jul 23Aug 23Sep 23Oct 23

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2023-43961	High	2023-10-25	No exploit published	Proof of concept only	An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.
CVE-2023-3276	High	2023-06-15	Protected by Waratek	Proof of concept only	A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2023-43961

High

2023-10-25

No exploit published

Proof of concept only

An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authentication bypass.

CVE-2023-3276

High

2023-06-15

Protected by Waratek

Proof of concept only

A vulnerability, which was classified as problematic, has been found in Dromara HuTool up to 5.8.19. Affected by this issue is the function readBySax of the file XmlUtil.java of the component XML Parsing Module. The manipulation leads to xml external entity reference. The exploit has been disclosed to the public and may be used. VDB-231626 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.