WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product: GraalVM✕
Overview 6 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 2 EPSS ≥ 0.5
6matches 1in Waratek scope16.7% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 2EPSS ≥ 0.533.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 16.7% Outside Waratek scope 3 50.0% Not applicable 2 33.3% Withdrawn CVE 0 0.0%
Critical 6 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 6 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 2 33.3% No public exploit 4 66.7%
split by peak 3 / quarter
Not applicable: 2Outside Waratek scope: 3No exploit published: 1 Critical: 6 not blocked: 6 No public exploit: 4Forecast only: 2
Q1 203 No exploit published1 Outside Waratek scope2 Critical3 not blocked3 Forecast only1 No public exploit2 Q2 200 Q3 200 Q4 201 Not applicable1 Critical1 not blocked1 Forecast only1 Q1 210 Q2 211 Outside Waratek scope1 Critical1 not blocked1 No public exploit1 Q3 211 Not applicable1 Critical1 not blocked1 No public exploit1
Q1 20Q2 20Q3 20Q4 20Q1 21Q2 21Q3 21
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-22931 Critical 2021-08-16 Not applicable No public exploit Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVE-2021-29921 Critical 2021-05-06 Outside Waratek scope No public exploit In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses.
CVE-2020-7774 Critical 2020-11-17 Not applicable Forecast only The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
CVE-2019-17560 Critical 2020-03-30 No exploit published No public exploit The "Apache NetBeans" autoupdate system does not validate SSL certificates and hostnames for https based downloads. This allows an attacker to intercept downloads of autoupdates and modify the download, potentially injecting malicious code. “Apache NetBeans" versions up to and including 11.2 are affected by this vulnerability.
CVE-2019-15606 Critical 2020-02-07 Outside Waratek scope No public exploit Including trailing white space in HTTP header values in Nodejs 10, 12, and 13 causes bypass of authorization based on header value comparisons
CVE-2019-15605 Critical 2020-02-07 Outside Waratek scope Forecast only HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed