WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕Product application✕
Overview 7 matches · 4 protected · 0 exploited · 0 CISA KEV
7matches 4protected57.1% 0exploited0.0% 0CISA KEV0.0%
Protected by Waratek 4 57.1% Rule in development 0 0.0% Mitigation candidate 3 42.9% No exploit published 0 0.0%
Critical 3 42.9% High 2 28.6% Medium 2 28.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 57.1% partly blocked 0 0.0% not blocked 3 42.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 7 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Mitigation candidate: 3Protected by Waratek: 4 Medium: 2High: 2Critical: 3 not blocked: 3blocked by ARMR today: 4 Working exploit published: 7
20111 Mitigation candidate1 High1 not blocked1 Working exploit published1 20120 20130 20141 Mitigation candidate1 High1 not blocked1 Working exploit published1 20150 20162 Protected by Waratek1 Mitigation candidate1 Medium2 blocked by ARMR today1 not blocked1 Working exploit published2 20172 Protected by Waratek2 Critical2 blocked by ARMR today2 Working exploit published2 20180 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1
201120122013201420152016201720182019
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-4279 Critical 2019-05-17 Protected by Waratek Working exploit published IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.
CVE-2017-12629 Critical 2017-10-14 Protected by Waratek Working exploit published Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2016-0492 Medium 2016-01-21 Protected by Waratek Working exploit published Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different vulnerability than CVE-2016-0488. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that this is a directory traversal vulnerability in the isAllowedUrl function, which allows remote attackers to bypass authentication via directory traversal sequences following a URI entry that does not require authentication, as demonstrated by olt/Login.do/../../olt/UploadFileUpload.do.
CVE-2016-0491 Medium 2016-01-21 Mitigation candidate Working exploit published Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps. NOTE: the previous information is from the January 2016 CPU. Oracle has not commented on third-party claims that the UploadFileAction servlet allows remote authenticated users to upload and execute arbitrary files via an * (asterisk) character in the fileType parameter.
CVE-2014-0050 High 2014-04-01 Mitigation candidate Working exploit published MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.
CVE-2011-0807 High 2011-04-20 Mitigation candidate Working exploit published Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration.