WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕Oracle product: Oracle MySQL✕
Overview 5 matches · 1 protected · 3 exploited · 3 CISA KEV · 4 public PoC
5matches 1protected20.0% 3exploited60.0% 3CISA KEV60.0% 4public PoC80.0%
Protected by Waratek 2 40.0% Rule in development 0 0.0% Mitigation candidate 2 40.0% No exploit published 1 20.0%
Critical 0 0.0% High 5 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 20.0% partly blocked 1 20.0% not blocked 3 60.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 60.0% Working exploit published 1 20.0% Proof of concept only 0 0.0% Forecast only 1 20.0% No public exploit 0 0.0%
split by peak 1 / year
No exploit published: 1Mitigation candidate: 2Protected by Waratek: 2 High: 5 not blocked: 3partly blocked: 1blocked by ARMR today: 1 Forecast only: 1Working exploit published: 1Exploited: 3
20171 Protected by Waratek1 High1 partly blocked1 Exploited1 20181 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20191 No exploit published1 High1 not blocked1 Forecast only1 20201 Mitigation candidate1 High1 not blocked1 Working exploit published1 20210 20220 20231 Mitigation candidate1 High1 not blocked1 Exploited1
2017201820192020202120222023
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2020-13935 High 2020-07-14 Mitigation candidate Working exploit published The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
CVE-2019-10072 High 2019-06-21 No exploit published Forecast only The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.
CVE-2018-11776 High 2018-08-22 Protected by Waratek Exploited Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time, its upper package have no or wildcard namespace and similar to results, same possibility when using url tag which doesn't have value and action set and in same time, its upper package have no or wildcard namespace.
CVE-2017-12617 High 2017-10-04 Protected by Waratek Exploited When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.