WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕EPSS ≥ 0.5✕Product xwork✕
Overview 12 matches · 7 in Waratek scope · 2 protected · 5 exploited · 1 CISA KEV · 9 public PoC
12matches 7in Waratek scope58.3% 2protected16.7% 5exploited41.7% 1CISA KEV8.3% 9public PoC75.0%
Protected by Waratek 2 16.7% Rule in development 0 0.0% Mitigation candidate 5 41.7% No exploit published 0 0.0% Outside Waratek scope 4 33.3% Not applicable 1 8.3% Withdrawn CVE 0 0.0%
Critical 3 25.0% High 5 41.7% Medium 4 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 16.7% partly blocked 0 0.0% not blocked 10 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 5 41.7% Working exploit published 4 33.3% Proof of concept only 0 0.0% Forecast only 3 25.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 1Outside Waratek scope: 4Mitigation candidate: 5Protected by Waratek: 2 Medium: 4High: 5Critical: 3 not blocked: 10blocked by ARMR today: 2 Forecast only: 3Working exploit published: 4Exploited: 5
20101 Not applicable1 Critical1 not blocked1 Forecast only1 20110 20123 Protected by Waratek1 Mitigation candidate1 Outside Waratek scope1 Critical1 Medium2 blocked by ARMR today1 not blocked2 Exploited1 Working exploit published2 20133 Mitigation candidate3 High3 not blocked3 Exploited1 Working exploit published2 20141 Mitigation candidate1 Medium1 not blocked1 Exploited1 20150 20160 20170 20180 20193 Outside Waratek scope3 Critical1 High1 Medium1 not blocked3 Exploited1 Forecast only2 20200 20210 20220 20230 20240 20250 20261 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1
201020122014201620182020202220242026
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-68493 High 2026-01-11 Protected by Waratek Exploited Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 through 6.1.0. Users are recommended to upgrade to version 6.1.1, which fixes the issue.
CVE-2019-12265 Medium 2019-08-09 Outside Waratek scope Forecast only Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. There is an IPNET security vulnerability: IGMP Information leak via IGMPv3 specific membership report.
CVE-2019-12257 High 2019-08-09 Outside Waratek scope Forecast only Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. There is an IPNET security vulnerability: Heap overflow in DHCP Offer/ACK parsing inside ipdhcpc.
CVE-2019-12255 Critical 2019-08-09 Outside Waratek scope Exploited Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
CVE-2014-0094 Medium 2014-03-11 Mitigation candidate Exploited The ParametersInterceptor in Apache Struts before 2.3.16.2 allows remote attackers to "manipulate" the ClassLoader via the class parameter, which is passed to the getClass method.
CVE-2013-2134 High 2013-07-16 Mitigation candidate Exploited Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
CVE-2013-2115 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
CVE-2013-1966 High 2013-07-10 Mitigation candidate Working exploit published Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag.
CVE-2012-0394 Medium 2012-01-08 Outside Waratek scope Working exploit published The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself.
CVE-2012-0392 Medium 2012-01-08 Mitigation candidate Working exploit published The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary commands via a crafted HTTP Cookie header that triggers Java code execution through a static method.
CVE-2012-0391 Critical 2012-01-08 Protected by Waratek Exploited The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
CVE-2010-2965 Critical 2010-08-05 Not applicable Forecast only The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read or modify arbitrary memory locations, perform function calls, or manage tasks via requests to UDP port 17185, a related issue to CVE-2005-3804.