WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product cloud backup✕
Overview 13 matches · 1 in Waratek scope · 1 protected · 10 CISA KEV · 12 public PoC · 12 EPSS ≥ 0.5
13matches 1in Waratek scope7.7% 1protected7.7% 10CISA KEV76.9% 12public PoC92.3% 12EPSS ≥ 0.592.3%
Protected by Waratek 1 7.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 8 61.5% Not applicable 4 30.8% Withdrawn CVE 0 0.0%
Critical 4 30.8% High 6 46.2% Medium 3 23.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 7.7% partly blocked 0 0.0% not blocked 12 92.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 13 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 6 / year
Not applicable: 4Outside Waratek scope: 8Protected by Waratek: 1 Medium: 3High: 6Critical: 4 not blocked: 12blocked by ARMR today: 1 Exploited: 13
20161 Outside Waratek scope1 High1 not blocked1 Exploited1 20170 20181 Outside Waratek scope1 High1 not blocked1 Exploited1 20192 Outside Waratek scope2 High1 Medium1 not blocked2 Exploited2 20201 Outside Waratek scope1 Medium1 not blocked1 Exploited1 20216 Protected by Waratek1 Outside Waratek scope3 Not applicable2 Critical3 High3 blocked by ARMR today1 not blocked5 Exploited6 20220 20230 20240 20250 20262 Not applicable2 Critical1 Medium1 not blocked2 Exploited2
20162017201820192020202120222023202420252026
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-105134 Critical 2026-10-04 Not applicable Exploited A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to resolve this issue. Upgrading the affected component is advised. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CVE-2026-105133 Medium 2026-10-04 Not applicable Exploited A vulnerability was detected in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This affects the function checkSysPwd of the file com/ahsay/obs/api/ApiStructsAction.java of the component API. Performing a manipulation of the argument random results in improper authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 9.15.2.70 and 10.3.4.45 is able to mitigate this issue. It is recommended to upgrade the affected component. The initial patch did not fix the security vulnerability properly. An update of the CVE entry to reflect this became necessary.
CVE-2021-4104 High 2021-12-14 Protected by Waratek Exploited JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-42013 Critical 2021-10-07 Not applicable Exploited It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2021-41773 Critical 2021-10-05 Not applicable Exploited A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.
CVE-2021-40438 Critical 2021-09-16 Outside Waratek scope Exploited A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2021-22555 High 2021-07-07 Outside Waratek scope Exploited A heap out-of-bounds write affecting Linux since v2.6.19-rc1 was discovered in net/netfilter/x_tables.c. This allows an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space
CVE-2021-3156 High 2021-01-26 Outside Waratek scope Exploited Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
CVE-2020-11023 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2019-2215 High 2019-10-11 Outside Waratek scope Exploited A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
CVE-2018-20685 Medium 2019-01-10 Outside Waratek scope Exploited In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side.
CVE-2018-8011 High 2018-07-18 Outside Waratek scope Exploited By specially crafting HTTP requests, the mod_md challenge handler would dereference a NULL pointer and cause the child process to segfault. This could be used to DoS the server. Fixed in Apache HTTP Server 2.4.34 (Affected 2.4.33).
CVE-2016-5195 High 2016-11-10 Outside Waratek scope Exploited Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."