WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Oracle product: Oracle Virtualization✕
Overview 17 matches · 2 in Waratek scope · 2 protected · 2 exploited · 1 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
17matches 2in Waratek scope11.8% 2protected11.8% 2exploited11.8% 1CISA KEV5.9% 3public PoC17.6% 3EPSS ≥ 0.517.6%
Protected by Waratek 2 11.8% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 3 17.6% Not applicable 12 70.6% Withdrawn CVE 0 0.0%
Critical 17 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 11.8% partly blocked 0 0.0% not blocked 15 88.2% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 11.8% Working exploit published 1 5.9% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 14 82.4%
split by peak 3 / quarter
Not applicable: 12Outside Waratek scope: 3Protected by Waratek: 2 Critical: 17 not blocked: 15blocked by ARMR today: 2 No public exploit: 14Working exploit published: 1Exploited: 2
Q4 151 Not applicable1 Critical1 not blocked1 No public exploit1 Q1 160 Q2 160 Q3 161 Not applicable1 Critical1 not blocked1 No public exploit1 Q4 163 Not applicable3 Critical3 not blocked3 No public exploit3 Q1 170 Q2 172 Protected by Waratek1 Outside Waratek scope1 Critical2 blocked by ARMR today1 not blocked1 Working exploit published1 No public exploit1 Q3 170 Q4 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q1 180 Q2 181 Not applicable1 Critical1 not blocked1 No public exploit1 Q3 180 Q4 181 Not applicable1 Critical1 not blocked1 No public exploit1 Q1 191 Outside Waratek scope1 Critical1 not blocked1 No public exploit1 Q2 190 Q3 190 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 213 Not applicable3 Critical3 not blocked3 No public exploit3 Q3 213 Outside Waratek scope1 Not applicable2 Critical3 not blocked3 Exploited1 No public exploit2
Q1 16Q3 16Q1 17Q3 17Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21
17 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-40438 Critical 2021-09-16 Outside Waratek scope Exploited A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-2447 Critical 2021-07-21 Not applicable No public exploit Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported version that is affected is 5.6. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle Secure Global Desktop. While the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Secure Global Desktop. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2021-2446 Critical 2021-07-21 Not applicable No public exploit Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affected is 5.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Secure Global Desktop. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Secure Global Desktop. CVSS 3.1 Base Score 9.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVE-2021-2248 Critical 2021-04-22 Not applicable No public exploit Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Server). The supported version that is affected is 5.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Secure Global Desktop. While the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Secure Global Desktop.
CVE-2021-2221 Critical 2021-04-22 Not applicable No public exploit Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Client). The supported version that is affected is 5.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Secure Global Desktop. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Secure Global Desktop.
CVE-2021-2177 Critical 2021-04-22 Not applicable No public exploit Vulnerability in the Oracle Secure Global Desktop product of Oracle Virtualization (component: Gateway). The supported version that is affected is 5.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Secure Global Desktop. While the vulnerability is in Oracle Secure Global Desktop, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Secure Global Desktop.
CVE-2019-3822 Critical 2019-02-06 Outside Waratek scope No public exploit libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.
CVE-2018-3294 Critical 2018-10-17 Not applicable No public exploit Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to 5.2.20. Easily exploitable vulnerability allows low privileged attacker with network access via VRDP to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H).
CVE-2018-1000300 Critical 2018-05-24 Not applicable No public exploit curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.. This vulnerability appears to have been fixed in curl < 7.54.1 and curl >= 7.60.0.
CVE-2015-7501 Critical 2017-11-09 Protected by Waratek Exploited Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVE-2017-3167 Critical 2017-06-20 Outside Waratek scope No public exploit In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2016-5407 Critical 2016-12-13 Not applicable No public exploit The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memory access operations via vectors involving length specifications in received data.
CVE-2016-5605 Critical 2016-10-25 Not applicable No public exploit Unspecified vulnerability in the Oracle VM VirtualBox component before 5.1.4 in Oracle Virtualization allows remote attackers to affect confidentiality and integrity via vectors related to VRDE.
CVE-2016-5580 Critical 2016-10-25 Not applicable No public exploit Unspecified vulnerability in the Secure Global Desktop component in Oracle Virtualization 4.7 and 5.2 allows remote authenticated users to affect confidentiality and availability via vectors through Web Services.
CVE-2016-3613 Critical 2016-07-21 Not applicable No public exploit Unspecified vulnerability in the Oracle Secure Global Desktop component in Oracle Virtualization 4.63, 4.71, and 5.2 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to OpenSSL.
CVE-2015-8104 Critical 2015-11-16 Not applicable No public exploit The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.