WaratekVRT Sign in

Exploited Case CVEs

4 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Product case✕
Overview 4 matches · 3 protected · 2 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
4matches 3protected75.0% 2CISA KEV50.0% 3public PoC75.0% 3EPSS ≥ 0.575.0%
Protected by Waratek 3 75.0% Rule in development 0 0.0% Mitigation candidate 1 25.0% No exploit published 0 0.0%
Critical 2 50.0% High 1 25.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 75.0% partly blocked 0 0.0% not blocked 1 25.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Mitigation candidate: 1Protected by Waratek: 3 Medium: 1High: 1Critical: 2 not blocked: 1blocked by ARMR today: 3 Exploited: 4
20131 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20140 20150 20160 20170 20180 20190 20200 20211 Mitigation candidate1 Medium1 not blocked1 Exploited1 20222 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited2
2013201420152016201720182019202020212022
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-22965 Critical 2022-04-01 Protected by Waratek Exploited A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22963 Critical 2022-04-01 Protected by Waratek Exploited In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2021-38153 Medium 2021-09-22 Mitigation candidate Exploited Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
CVE-2013-1965 High 2013-07-10 Protected by Waratek Exploited Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.