WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕EPSS ≥ 0.5✕Product communications application session controller✕
Overview 8 matches · 1 in Waratek scope · 1 protected · 3 exploited · 1 CISA KEV · 6 public PoC
8matches 1in Waratek scope12.5% 1protected12.5% 3exploited37.5% 1CISA KEV12.5% 6public PoC75.0%
Protected by Waratek 1 12.5% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 7 87.5% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 1 12.5% High 2 25.0% Medium 4 50.0% Low 1 12.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 12.5% partly blocked 0 0.0% not blocked 7 87.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 37.5% Working exploit published 3 37.5% Proof of concept only 0 0.0% Forecast only 2 25.0% No public exploit 0 0.0%
split by peak 2 / year
Outside Waratek scope: 7Protected by Waratek: 1 Low: 1Medium: 4High: 2Critical: 1 not blocked: 7blocked by ARMR today: 1 Forecast only: 2Working exploit published: 3Exploited: 3
20131 Outside Waratek scope1 Medium1 not blocked1 Forecast only1 20140 20152 Outside Waratek scope2 High1 Low1 not blocked2 Working exploit published1 Forecast only1 20160 20172 Protected by Waratek1 Outside Waratek scope1 Critical1 High1 blocked by ARMR today1 not blocked1 Exploited1 Working exploit published1 20181 Outside Waratek scope1 Medium1 not blocked1 Working exploit published1 20191 Outside Waratek scope1 Medium1 not blocked1 Exploited1 20201 Outside Waratek scope1 Medium1 not blocked1 Exploited1
20132014201520162017201820192020
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-11022 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2019-11358 Medium 2019-04-20 Outside Waratek scope Exploited jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVE-2018-11784 Medium 2018-10-04 Outside Waratek scope Working exploit published When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVE-2017-3730 High 2017-05-04 Outside Waratek scope Working exploit published In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
CVE-2016-8735 Critical 2017-04-06 Protected by Waratek Exploited Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
CVE-2015-2808 Low 2015-04-01 Outside Waratek scope Forecast only The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
CVE-2015-0235 High 2015-01-28 Outside Waratek scope Working exploit published Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
CVE-2013-2566 Medium 2013-03-15 Outside Waratek scope Forecast only The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.