WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product oncommand unified manager✕
Overview 7 matches · 2 in Waratek scope · 2 protected · 5 CISA KEV · 4 public PoC
7matches 2in Waratek scope28.6% 2protected28.6% 5CISA KEV71.4% 4public PoC57.1%
Protected by Waratek 2 28.6% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 5 71.4% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 2 28.6% High 5 71.4% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 28.6% partly blocked 0 0.0% not blocked 5 71.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 7 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Outside Waratek scope: 5Protected by Waratek: 2 High: 5Critical: 2 not blocked: 5blocked by ARMR today: 2 Exploited: 7
20101 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20110 20120 20130 20140 20150 20162 Protected by Waratek1 Outside Waratek scope1 Critical1 High1 blocked by ARMR today1 not blocked1 Exploited2 20172 Outside Waratek scope2 Critical1 High1 not blocked2 Exploited2 20180 20191 Outside Waratek scope1 High1 not blocked1 Exploited1 20200 20211 Outside Waratek scope1 High1 not blocked1 Exploited1
201020112012201320142015201620172018201920202021
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-3156 High 2021-01-26 Outside Waratek scope Exploited Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
CVE-2019-0211 High 2019-04-08 Outside Waratek scope Exploited In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.
CVE-2017-9788 Critical 2017-07-13 Outside Waratek scope Exploited In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.
CVE-2017-7668 High 2017-06-20 Outside Waratek scope Exploited The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
CVE-2016-5195 High 2016-11-10 Outside Waratek scope Exploited Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a read-only memory mapping, as exploited in the wild in October 2016, aka "Dirty COW."
CVE-2016-3427 Critical 2016-04-21 Protected by Waratek Exploited Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2010-1871 High 2010-08-05 Protected by Waratek Exploited JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. NOTE: this is only a vulnerability when the Java Security Manager is not properly configured.