git CVEs · Protected by Waratek

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 1 exploited · 1 CISA KEV

2matches 1exploited50.0% 1CISA KEV50.0%

Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%

Critical 0 0.0% High 1 50.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 50.0% Working exploit published 1 50.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / quarter

Q3 171 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q4 170 Q1 180 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1

Q4 17Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2021-28164	Medium	2021-04-01	Protected by Waratek	Working exploit published	In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVE-2017-9805	High	2017-09-15	Protected by Waratek	Exploited	The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2021-28164

Medium

2021-04-01

Protected by Waratek

Working exploit published

In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVE-2017-9805

High

2017-09-15

Protected by Waratek

Exploited

The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.