WaratekVRT Sign in
Reset
More filters (1)
Columns
Published from 2023-12-01✕
Overview 2 matches · 0 exploited · 0 CISA KEV · 0 public PoC
2matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 2 100.0% No public exploit 0 0.0%
split by peak 1 / month
Protected by Waratek: 2 Critical: 2 blocked by ARMR today: 2 Forecast only: 2
Mar 241 Protected by Waratek1 Critical1 blocked by ARMR today1 Forecast only1 Apr 240 May 240 Jun 240 Jul 240 Aug 240 Sep 240 Oct 240 Nov 240 Dec 240 Jan 251 Protected by Waratek1 Critical1 blocked by ARMR today1 Forecast only1
Mar 24Apr 24May 24Jun 24Jul 24Aug 24Sep 24Oct 24Nov 24Dec 24Jan 25
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-54676 Critical 2025-01-08 Protected by Waratek Forecast only Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html  doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted data. Users are recommended to upgrade to version 8.0.0 and update their startup scripts to include the relevant 'openjpa.serialization.class.blacklist' and 'openjpa.serialization.class.whitelist' configurations as shown in the documentation.
CVE-2024-27317 Critical 2024-03-12 Protected by Waratek Forecast only In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in the zip files, which aren't properly validated, contain special elements like "..", altering the directory path. This could allow an attacker to create or modify files outside of the designated extraction directory, potentially influencing system behavior. This vulnerability also applies to the Pulsar Broker when it is configured with "functionsWorkerEnabled=true". This issue affects Apache Pulsar versions from 2.4.0 to 2.10.5, from 2.11.0 to 2.11.3, from 3.0.0 to 3.0.2, from 3.1.0 to 3.1.2, and 3.2.0. 2.10 Pulsar Function Worker users should upgrade to at least 2.10.6. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.4. 3.0 Pulsar Function Worker users should upgrade to at least 3.0.3. 3.1 Pulsar Function Worker users should upgrade to at least 3.1.3. 3.2 Pulsar Function Worker users should upgrade to at least 3.2.1. Users operating versions prior to those listed above should upgrade to the aforementioned patched versions or newer versions.