WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product jquery✕
Overview 7 matches · 0 in Waratek scope · 0 protected · 1 CISA KEV · 6 EPSS ≥ 0.5
7matches 0in Waratek scope0.0% 0protected0.0% 1CISA KEV14.3% 6EPSS ≥ 0.585.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 4 57.1% Not applicable 3 42.9% Withdrawn CVE 0 0.0%
Critical 2 28.6% High 1 14.3% Medium 4 57.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 7 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Not applicable: 3Outside Waratek scope: 4 Medium: 4High: 1Critical: 2 not blocked: 7 Exploited: 7
Q4 171 Not applicable1 High1 not blocked1 Exploited1 Q1 181 Outside Waratek scope1 Medium1 not blocked1 Exploited1 Q2 180 Q3 180 Q4 181 Not applicable1 Critical1 not blocked1 Exploited1 Q1 190 Q2 191 Outside Waratek scope1 Medium1 not blocked1 Exploited1 Q3 190 Q4 190 Q1 201 Not applicable1 Critical1 not blocked1 Exploited1 Q2 202 Outside Waratek scope2 Medium2 not blocked2 Exploited2
Q4 17Q1 18Q2 18Q3 18Q4 18Q1 19Q2 19Q3 19Q4 19Q1 20Q2 20
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-11023 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-11022 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2014-8739 Critical 2020-02-08 Not applicable Exploited Unrestricted file upload vulnerability in server/php/UploadHandler.php in the jQuery File Upload Plugin 6.4.4 for jQuery, as used in the Creative Solutions Creative Contact Form (formerly Sexy Contact Form) before 1.0.0 for WordPress and before 2.0.1 for Joomla!, allows remote attackers to execute arbitrary code by uploading a PHP file with an PHP extension, then accessing it via a direct request to the file in files/, as exploited in the wild in October 2014.
CVE-2019-11358 Medium 2019-04-20 Outside Waratek scope Exploited jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVE-2018-9206 Critical 2018-10-11 Not applicable Exploited Unauthenticated arbitrary file upload vulnerability in Blueimp jQuery-File-Upload <= v9.22.0
CVE-2015-9251 Medium 2018-01-18 Outside Waratek scope Exploited jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVE-2017-1000170 High 2017-11-17 Not applicable Exploited jqueryFileTree 2.1.5 and older Directory Traversal