WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕EPSS ≥ 0.5✕Product oncommand unified manager✕
Overview 11 matches · 2 in Waratek scope · 2 protected · 7 exploited · 5 CISA KEV · 6 public PoC
11matches 2in Waratek scope18.2% 2protected18.2% 7exploited63.6% 5CISA KEV45.5% 6public PoC54.5%
Protected by Waratek 2 18.2% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 9 81.8% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 4 36.4% High 5 45.5% Medium 2 18.2% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 18.2% partly blocked 0 0.0% not blocked 9 81.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 7 63.6% Working exploit published 2 18.2% Proof of concept only 0 0.0% Forecast only 2 18.2% No public exploit 0 0.0%
split by peak 3 / year
Outside Waratek scope: 9Protected by Waratek: 2 Medium: 2High: 5Critical: 4 not blocked: 9blocked by ARMR today: 2 Forecast only: 2Working exploit published: 2Exploited: 7
20101 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20110 20120 20130 20140 20150 20162 Protected by Waratek1 Outside Waratek scope1 Critical1 High1 blocked by ARMR today1 not blocked1 Exploited2 20173 Outside Waratek scope3 Critical2 High1 not blocked3 Exploited2 Forecast only1 20182 Outside Waratek scope2 Critical1 Medium1 not blocked2 Working exploit published2 20191 Outside Waratek scope1 High1 not blocked1 Exploited1 20201 Outside Waratek scope1 Medium1 not blocked1 Forecast only1 20211 Outside Waratek scope1 High1 not blocked1 Exploited1
201020112012201320142015201620172018201920202021
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-3156 High 2021-01-26 Outside Waratek scope Exploited Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
CVE-2020-1927 Medium 2020-04-02 Outside Waratek scope Forecast only In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
CVE-2019-0211 High 2019-04-08 Outside Waratek scope Exploited In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
CVE-2018-10933 Critical 2018-10-17 Outside Waratek scope Working exploit published A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.
CVE-2018-15473 Medium 2018-08-17 Outside Waratek scope Working exploit published OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
CVE-2015-7871 Critical 2017-08-07 Outside Waratek scope Forecast only Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
CVE-2017-9788 Critical 2017-07-13 Outside Waratek scope Exploited In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.
CVE-2017-7668 High 2017-06-20 Outside Waratek scope Exploited The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
CVE-2016-5195 High 2016-11-10 Outside Waratek scope Exploited Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
CVE-2016-3427 Critical 2016-04-21 Protected by Waratek Exploited Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2010-1871 High 2010-08-05 Protected by Waratek Exploited JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.