WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕EPSS ≥ 0.5✕Product secure backup✕
Overview 7 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 6 public PoC
7matches 0in Waratek scope0.0% 0protected0.0% 1exploited14.3% 1CISA KEV14.3% 6public PoC85.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 2 28.6% Not applicable 5 71.4% Withdrawn CVE 0 0.0%
Critical 2 28.6% High 3 42.9% Medium 2 28.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 4 57.1% Proof of concept only 1 14.3% Forecast only 1 14.3% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 5Outside Waratek scope: 2 Medium: 2High: 3Critical: 2 not blocked: 7 Forecast only: 1Proof of concept only: 1Working exploit published: 4Exploited: 1
20093 Not applicable3 High3 not blocked3 Working exploit published3 20101 Not applicable1 Medium1 not blocked1 Working exploit published1 20110 20120 20130 20140 20150 20160 20170 20180 20190 20200 20213 Outside Waratek scope2 Not applicable1 Critical2 Medium1 not blocked3 Exploited1 Proof of concept only1 Forecast only1
2009201120132015201720192021
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-42013 Critical 2021-10-07 Not applicable Exploited It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2021-26691 Critical 2021-06-10 Outside Waratek scope Forecast only In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow
CVE-2021-3449 Medium 2021-03-25 Outside Waratek scope Proof of concept only An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).
CVE-2010-0904 Medium 2010-07-13 Not applicable Working exploit published Unspecified vulnerability in Oracle Secure Backup 10.3.0.1 allows remote attackers to affect integrity via unknown vectors.
CVE-2009-1978 High 2009-07-14 Not applicable Working exploit published Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows remote authenticated users to execute arbitrary code with SYSTEM privileges via vectors involving property_box.php.
CVE-2009-1977 High 2009-07-14 Not applicable Working exploit published Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.3 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the July 2009 Oracle CPU. Oracle has not commented on claims from an independent researcher that this vulnerability allows attackers to bypass authentication via unknown vectors involving the username parameter and login.php.
CVE-2008-5444 High 2009-01-14 Not applicable Working exploit published Unspecified vulnerability in the Oracle Secure Backup component in Oracle Secure Backup 10.2.0.2 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2008-5448 and CVE-2008-5449.