WaratekVRT Sign in

Exploited Primavera Unifier CVEs

6 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Product primavera unifier✕
Overview 6 matches · 2 protected · 1 CISA KEV · 4 public PoC · 3 EPSS ≥ 0.5
6matches 2protected33.3% 1CISA KEV16.7% 4public PoC66.7% 3EPSS ≥ 0.550.0%
Protected by Waratek 3 50.0% Rule in development 0 0.0% Mitigation candidate 3 50.0% No exploit published 0 0.0%
Critical 2 33.3% High 1 16.7% Medium 3 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 33.3% partly blocked 1 16.7% not blocked 3 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 6 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Mitigation candidate: 3Protected by Waratek: 3 Medium: 3High: 1Critical: 2 not blocked: 3partly blocked: 1blocked by ARMR today: 2 Exploited: 6
Q4 191 Protected by Waratek1 High1 partly blocked1 Exploited1 Q1 202 Mitigation candidate2 Critical2 not blocked2 Exploited2 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 211 Mitigation candidate1 Medium1 not blocked1 Exploited1 Q4 212 Protected by Waratek2 Medium2 blocked by ARMR today2 Exploited2
Q4 19Q1 20Q2 20Q3 20Q4 20Q1 21Q2 21Q3 21Q4 21
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-44832 Medium 2021-12-28 Protected by Waratek Exploited Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVE-2021-45105 Medium 2021-12-18 Protected by Waratek Exploited Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2021-38153 Medium 2021-09-22 Mitigation candidate Exploited Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.
CVE-2020-9548 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2020-9547 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVE-2019-17558 High 2019-12-30 Protected by Waratek Exploited Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable, potentially malicious, templates. Parameter provided templates are disabled by default, but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely, and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).