Overview 5 matches · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
2
40.0%
No exploit published
3
60.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
5
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
40.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
3
60.0%
split by
peak 3 / quarter
Q2 181
Mitigation candidate1
High1
not blocked1
Working exploit published1
Q3 180
Q4 180
Q1 190
Q2 191
Mitigation candidate1
Medium1
not blocked1
Working exploit published1
Q3 190
Q4 190
Q1 200
Q2 200
Q3 200
Q4 200
Q1 210
Q2 210
Q3 210
Q4 210
Q1 223
No exploit published3
Medium3
not blocked3
No public exploit3
Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2021-36739 | Medium | 2022-01-06 | No exploit published | No public exploit | The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks. |
| CVE-2021-36738 | Medium | 2022-01-06 | No exploit published | No public exploit | The input fields in the JSP version of the Apache Pluto Applicant MVCBean CDI portlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the applicant-mvcbean-cdi-jsp-portlet.war artifact |
| CVE-2021-36737 | Medium | 2022-01-06 | No exploit published | No public exploit | The input fields of the Apache Pluto UrlTestPortlet are vulnerable to Cross-Site Scripting (XSS) attacks. Users should migrate to version 3.1.1 of the v3-demo-portlet.war artifact |
| CVE-2019-0186 | Medium | 2019-04-26 | Mitigation candidate | Working exploit published | The input fields of the Apache Pluto "Chat Room" demo portlet 3.0.0 and 3.0.1 are vulnerable to Cross-Site Scripting (XSS) attacks. Mitigation: * Uninstall the ChatRoomDemo war file - or - * migrate to version 3.1.0 of the chat-room-demo war file |
| CVE-2018-1306 | High | 2018-06-27 | Mitigation candidate | Working exploit published | The PortletV3AnnotatedDemo Multipart Portlet war file code provided in Apache Pluto version 3.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to restrict path information provided during a file upload. An attacker could exploit this vulnerability to obtain configuration data and other sensitive information. |