WaratekVRT Sign in
Reset
More filters (1)
Columns
Oracle product: Oracle MySQL✕
Overview 4 matches · 2 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
4matches 2exploited50.0% 0CISA KEV0.0% 1public PoC25.0% 1EPSS ≥ 0.525.0%
Protected by Waratek 4 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 4 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 50.0%
split by peak 1 / month
Protected by Waratek: 4 Medium: 4 blocked by ARMR today: 4 No public exploit: 2Exploited: 2
Apr 211 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 May 210 Jun 210 Jul 210 Aug 210 Sep 210 Oct 210 Nov 210 Dec 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 Jan 220 Feb 220 Mar 220 Apr 220 May 221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Jun 221 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1
Apr 21Jun 21Aug 21Oct 21Dec 21Feb 22Apr 22Jun 22
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-34305 Medium 2022-06-23 Protected by Waratek Exploited In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability.
CVE-2022-22971 Medium 2022-05-12 Protected by Waratek No public exploit In spring framework versions prior to 5.3.20+ , 5.2.22+ and old unsupported versions, application with a STOMP over WebSocket endpoint is vulnerable to a denial of service attack by an authenticated user.
CVE-2021-44832 Medium 2021-12-28 Protected by Waratek Exploited Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVE-2021-29425 Medium 2021-04-13 Protected by Waratek No public exploit In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.