WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product enterprise server✕
Overview 13 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC
13matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 7.7% Not applicable 12 92.3% Withdrawn CVE 0 0.0%
Critical 1 7.7% High 7 53.8% Medium 4 30.8% Low 1 7.7% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 13 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 13 100.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 12Outside Waratek scope: 1 Low: 1Medium: 4High: 7Critical: 1 not blocked: 13 Forecast only: 13
20142 Not applicable2 Medium2 not blocked2 Forecast only2 20151 Outside Waratek scope1 Low1 not blocked1 Forecast only1 20162 Not applicable2 High1 Medium1 not blocked2 Forecast only2 20170 20182 Not applicable2 Critical1 High1 not blocked2 Forecast only2 20190 20201 Not applicable1 High1 not blocked1 Forecast only1 20210 20223 Not applicable3 High3 not blocked3 Forecast only3 20231 Not applicable1 Medium1 not blocked1 Forecast only1 20241 Not applicable1 High1 not blocked1 Forecast only1
20142015201620172018201920202021202220232024
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-0507 High 2024-01-16 Not applicable Forecast only An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.11.3, 3.10.5, 3.9.8, and 3.8.13 This vulnerability was reported via the GitHub Bug Bounty program.
CVE-2023-24950 Medium 2023-05-09 Not applicable Forecast only Microsoft SharePoint Server Spoofing Vulnerability
CVE-2022-38053 High 2022-10-11 Not applicable Forecast only Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2022-37961 High 2022-09-13 Not applicable Forecast only Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2022-35823 High 2022-09-13 Not applicable Forecast only Microsoft SharePoint Remote Code Execution Vulnerability
CVE-2020-1181 High 2020-06-09 Not applicable Forecast only A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.
CVE-2018-16873 High 2018-12-14 Not applicable Forecast only In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".
CVE-2017-18017 Critical 2018-01-03 Not applicable Forecast only The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.
CVE-2016-1286 High 2016-03-09 Not applicable Forecast only named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.
CVE-2016-1285 Medium 2016-03-09 Not applicable Forecast only named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 does not properly handle DNAME records when parsing fetch reply messages, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed packet to the rndc (aka control channel) interface, related to alist.c and sexpr.c.
CVE-2015-2808 Low 2015-04-01 Outside Waratek scope Forecast only The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
CVE-2014-3470 Medium 2014-06-05 Not applicable Forecast only The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h, when an anonymous ECDH cipher suite is used, allows remote attackers to cause a denial of service (NULL pointer dereference and client crash) by triggering a NULL certificate value.
CVE-2014-0221 Medium 2014-06-05 Not applicable Forecast only The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.