WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product nginx✕
Overview 6 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC
6matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 3 50.0% Not applicable 3 50.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 4 66.7% Medium 2 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 6 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 6 100.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 3Outside Waratek scope: 3 Medium: 2High: 4 not blocked: 6 Forecast only: 6
20161 Not applicable1 High1 not blocked1 Forecast only1 20170 20180 20193 Outside Waratek scope3 High2 Medium1 not blocked3 Forecast only3 20200 20210 20221 Not applicable1 Medium1 not blocked1 Forecast only1 20231 Not applicable1 High1 not blocked1 Forecast only1
20162017201820192020202120222023
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-5044 High 2023-10-25 Not applicable Forecast only Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.
CVE-2022-28379 Medium 2022-04-03 Not applicable Forecast only jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.
CVE-2019-9516 Medium 2019-08-13 Outside Waratek scope Forecast only Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. The attacker sends a stream of headers with a 0-length header name and 0-length header value, optionally Huffman encoded into 1-byte or greater headers. Some implementations allocate memory for these headers and keep the allocation alive until the session dies. This can consume excess memory.
CVE-2019-9513 High 2019-08-13 Outside Waratek scope Forecast only Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consume excess CPU.
CVE-2019-9511 High 2019-08-13 Outside Waratek scope Forecast only Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.
CVE-2016-0742 High 2016-02-15 Not applicable Forecast only The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process crash) via a crafted UDP DNS response.