WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕EPSS ≥ 0.5✕Product web application firewall✕
Overview 9 matches · 2 in Waratek scope · 1 protected · 8 exploited · 6 CISA KEV · 7 public PoC
9matches 2in Waratek scope22.2% 1protected11.1% 8exploited88.9% 6CISA KEV66.7% 7public PoC77.8%
Protected by Waratek 1 11.1% Rule in development 0 0.0% Mitigation candidate 1 11.1% No exploit published 0 0.0% Outside Waratek scope 1 11.1% Not applicable 6 66.7% Withdrawn CVE 0 0.0%
Critical 6 66.7% High 1 11.1% Medium 2 22.2% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 11.1% partly blocked 0 0.0% not blocked 8 88.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 8 88.9% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 11.1% No public exploit 0 0.0%
split by peak 4 / year
Not applicable: 6Outside Waratek scope: 1Mitigation candidate: 1Protected by Waratek: 1 Medium: 2High: 1Critical: 6 not blocked: 8blocked by ARMR today: 1 Forecast only: 1Exploited: 8
20181 Outside Waratek scope1 Medium1 not blocked1 Exploited1 20190 20201 Not applicable1 Critical1 not blocked1 Exploited1 20214 Protected by Waratek1 Not applicable3 Critical3 Medium1 blocked by ARMR today1 not blocked3 Exploited3 Forecast only1 20220 20232 Mitigation candidate1 Not applicable1 Critical1 High1 not blocked2 Exploited2 20240 20250 20261 Not applicable1 Critical1 not blocked1 Exploited1
201820192020202120222023202420252026
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-8037 Critical 2026-06-04 Not applicable Exploited OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints
CVE-2023-46747 Critical 2023-10-26 Not applicable Exploited Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2021-45105 Medium 2021-12-18 Protected by Waratek Exploited Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2021-22992 Critical 2021-03-31 Not applicable Forecast only On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may allow remote code execution (RCE), leading to complete system compromise. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVE-2021-22991 Critical 2021-03-31 Not applicable Exploited On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3, undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization, which may trigger a buffer overflow, resulting in a DoS attack. In certain situations, it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVE-2021-22986 Critical 2021-03-31 Not applicable Exploited On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.1.x before 12.1.5.3 amd BIG-IQ 7.1.0.x before 7.1.0.3 and 7.0.0.x before 7.0.0.2, the iControl REST interface has an unauthenticated remote command execution vulnerability. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.
CVE-2020-5902 Critical 2020-07-01 Not applicable Exploited In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages.
CVE-2018-3639 Medium 2018-05-22 Outside Waratek scope Exploited Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.