WaratekVRT Sign in

Apple CVEs

8 CVEs, 2 exploited, 2 protected by Waratek

Reset
More filters (1)
Columns
Vendor apple✕
Overview 8 matches · 2 protected · 2 exploited · 2 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
8matches 2protected25.0% 2exploited25.0% 2CISA KEV25.0% 3public PoC37.5% 3EPSS ≥ 0.537.5%
Protected by Waratek 2 25.0% Rule in development 0 0.0% Mitigation candidate 2 25.0% No exploit published 4 50.0%
Critical 3 37.5% High 2 25.0% Medium 3 37.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 25.0% partly blocked 0 0.0% not blocked 6 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 25.0% Working exploit published 1 12.5% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 62.5%
split by peak 3 / year
No exploit published: 4Mitigation candidate: 2Protected by Waratek: 2 Medium: 3High: 2Critical: 3 not blocked: 6blocked by ARMR today: 2 No public exploit: 5Working exploit published: 1Exploited: 2
20011 No exploit published1 High1 not blocked1 No public exploit1 20020 20030 20040 20050 20060 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20180 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20201 Mitigation candidate1 Critical1 not blocked1 Working exploit published1 20211 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20223 No exploit published3 Medium3 not blocked3 No public exploit3 20231 Mitigation candidate1 High1 not blocked1 Exploited1
200120032005200720092011201320152017201920212023
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-37724 Medium 2022-09-14 No exploit published No public exploit Project Wonder WebObjects 1.0 through 5.4.3 is vulnerable to Arbitrary HTTP Header injection and URL- or Header-based XSS reflection in all web-server adaptor interfaces.
CVE-2022-29048 Medium 2022-04-12 No exploit published No public exploit A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attackers to connect to an attacker-specified URL.
CVE-2022-29046 Medium 2022-04-12 No exploit published No public exploit Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags (and more) parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission.
CVE-2021-44228 Critical 2021-12-10 Protected by Waratek Exploited Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2014-9390 Critical 2020-02-12 Mitigation candidate Working exploit published Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
CVE-2019-14379 Critical 2019-07-29 Protected by Waratek No public exploit SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVE-2001-1480 High 2001-12-31 No exploit published No public exploit Java Runtime Environment (JRE) and SDK 1.2 through 1.3.0_04 allows untrusted applets to access the system clipboard.