WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor sun✕
Overview 21 matches · 3 in Waratek scope · 2 protected · 2 CISA KEV · 15 public PoC · 15 EPSS ≥ 0.5
21matches 3in Waratek scope14.3% 2protected9.5% 2CISA KEV9.5% 15public PoC71.4% 15EPSS ≥ 0.571.4%
Protected by Waratek 2 9.5% Rule in development 0 0.0% Mitigation candidate 1 4.8% No exploit published 0 0.0% Outside Waratek scope 11 52.4% Not applicable 7 33.3% Withdrawn CVE 0 0.0%
Critical 2 9.5% High 17 81.0% Medium 2 9.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 9.5% partly blocked 0 0.0% not blocked 19 90.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 21 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 5 / year
Not applicable: 7Outside Waratek scope: 11Mitigation candidate: 1Protected by Waratek: 2 Medium: 2High: 17Critical: 2 not blocked: 19blocked by ARMR today: 2 Exploited: 21
19981 Not applicable1 High1 not blocked1 Exploited1 19990 20000 20013 Not applicable3 High3 not blocked3 Exploited3 20020 20032 Not applicable2 High2 not blocked2 Exploited2 20040 20050 20060 20070 20081 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20092 Mitigation candidate1 Not applicable1 High1 Medium1 not blocked2 Exploited2 20104 Outside Waratek scope4 High4 not blocked4 Exploited4 20111 Outside Waratek scope1 High1 not blocked1 Exploited1 20122 Outside Waratek scope2 Critical1 Medium1 not blocked2 Exploited2 20135 Protected by Waratek1 Outside Waratek scope4 Critical1 High4 blocked by ARMR today1 not blocked4 Exploited5
19992001200320052007200920112013
21 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2013-2471 High 2013-06-18 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect IntegerComponentRaster size checks."
CVE-2013-2465 Critical 2013-06-18 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
CVE-2013-2461 High 2013-06-18 Protected by Waratek Exploited Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier and 6 Update 45 and earlier; the Oracle JRockit component in Oracle Fusion Middleware R27.7.5 and earlier and R28.2.7 and earlier; and OpenJDK 7 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries. NOTE: the previous information is from the June and July 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass verification of XML signatures via vectors related to a "Missing check for [a] valid DOMCanonicalizationMethod canonicalization algorithm."
CVE-2013-1493 High 2013-03-05 Outside Waratek scope Exploited The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
CVE-2012-3213 High 2013-02-02 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11 and 6 through Update 38 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.
CVE-2012-5081 Medium 2012-10-16 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier, 6 Update 35 and earlier, 5.0 Update 36 and earlier, and 1.4.2_38 and earlier allows remote attackers to affect availability, related to JSSE.
CVE-2012-0507 Critical 2012-06-07 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Concurrency. NOTE: the previous information was obtained from the February 2012 Oracle CPU. Oracle has not commented on claims from a downstream vendor and third party researchers that this issue occurs because the AtomicReferenceArray class implementation does not ensure that the array is of the Object[] type, which allows attackers to cause a denial of service (JVM crash) or bypass Java sandbox restrictions. NOTE: this issue was originally mapped to CVE-2011-3571, but that identifier was already assigned to a different issue.
CVE-2010-4452 High 2011-02-17 Outside Waratek scope Exploited Unspecified vulnerability in the Deployment component in Java Runtime Environment (JRE) in Oracle Java SE and Java for Business 6 Update 23 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2010-3552 High 2010-10-19 Outside Waratek scope Exploited Unspecified vulnerability in the New Java Plug-in component in Oracle Java SE and Java for Business 6 Update 21 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2010-0886 High 2010-04-20 Outside Waratek scope Exploited Unspecified vulnerability in the Java Deployment Toolkit component in Oracle Java SE and Java for Business JDK and JRE 6 Update 10 through 19 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors.
CVE-2010-0842 High 2010-04-01 Outside Waratek scope Exploited Unspecified vulnerability in the Sound component in Oracle Java SE and Java for Business 6 Update 18, 5.0 Update 23, 1.4.2_25, and 1.3.1_27 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is an uncontrolled array index that allows remote attackers to execute arbitrary code via a MIDI file with a crafted MixerSequencer object, related to the GM_Song structure.
CVE-2010-0094 High 2010-04-01 Outside Waratek scope Exploited Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE and Java for Business 6 Update 18 and 5.0 Update 23 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. NOTE: the previous information was obtained from the March 2010 CPU. Oracle has not commented on claims from a reliable researcher that this is due to missing privilege checks during deserialization of RMIConnectionImpl objects, which allows remote attackers to call system-level Java functions via the ClassLoader of a constructor that is being deserialized.
CVE-2009-3867 High 2009-11-05 Mitigation candidate Exploited Stack-based buffer overflow in the HsbParser.getSoundBank function in Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before Update 17, SDK and JRE 1.3.x before 1.3.1_27, and SDK and JRE 1.4.x before 1.4.2_24 allows remote attackers to execute arbitrary code via a long file: URL in an argument, aka Bug Id 6854303.
CVE-2009-2445 Medium 2009-07-13 Not applicable Exploited Oracle iPlanet Web Server (formerly Sun Java System Web Server or Sun ONE Web Server) 6.1 before SP12, and 7.0 through Update 6, when running on Windows, allows remote attackers to read arbitrary JSP files via an alternate data stream syntax, as demonstrated by a .jsp::$DATA URI.
CVE-2008-5353 High 2008-12-05 Protected by Waratek Exploited The Java Runtime Environment (JRE) for Sun JDK and JRE 6 Update 10 and earlier; JDK and JRE 5.0 Update 16 and earlier; and SDK and JRE 1.4.2_18 and earlier does not properly enforce context of ZoneInfo objects during deserialization, which allows remote attackers to run untrusted applets and applications in a privileged context, as demonstrated by "deserializing Calendar objects".
CVE-2003-0694 High 2003-10-06 Not applicable Exploited The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c.
CVE-2003-0201 High 2003-05-05 Not applicable Exploited Buffer overflow in the call_trans2open function in trans2.c for Samba 2.2.x before 2.2.8a, 2.0.10 and earlier 2.0.x versions, and Samba-TNG before 0.3.2, allows remote attackers to execute arbitrary code.
CVE-2001-0797 High 2001-12-12 Not applicable Exploited Buffer overflow in login in various System V based operating systems allows remote attackers to execute arbitrary commands via a large number of arguments through services such as telnet and rlogin.
CVE-2001-0554 High 2001-08-14 Not applicable Exploited Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function.
CVE-2001-0236 High 2001-05-03 Not applicable Exploited Buffer overflow in Solaris snmpXdmid SNMP to DMI mapper daemon allows remote attackers to execute arbitrary commands via a long "indication" event.
CVE-1999-0502 High 1998-03-01 Not applicable Exploited A Unix account has a default, null, blank, or missing password.