WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕EPSS ≥ 0.5✕Vendor python✕
Overview 3 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC
3matches 0in Waratek scope0.0% 0protected0.0% 1exploited33.3% 0CISA KEV0.0% 1public PoC33.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 3 100.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 3 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 33.3% Working exploit published 0 0.0% Proof of concept only 2 66.7% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / year
Outside Waratek scope: 3 High: 3 not blocked: 3 Proof of concept only: 2Exploited: 1
20141 Outside Waratek scope1 High1 not blocked1 Exploited1 20150 20161 Outside Waratek scope1 High1 not blocked1 Proof of concept only1 20170 20180 20190 20200 20210 20221 Outside Waratek scope1 High1 not blocked1 Proof of concept only1
201420152016201720182019202020212022
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2018-25032 High 2022-03-25 Outside Waratek scope Proof of concept only zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.
CVE-2016-2183 High 2016-09-01 Outside Waratek scope Proof of concept only The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
CVE-2014-0224 High 2014-06-05 Outside Waratek scope Exploited OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.