WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product diagnostics✕
Overview 35 matches · 2 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
35matches 2in Waratek scope5.7% 1protected2.9% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 2.9% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 2.9% Outside Waratek scope 0 0.0% Not applicable 33 94.3% Withdrawn CVE 0 0.0%
Critical 5 14.3% High 18 51.4% Medium 11 31.4% Low 1 2.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 2.9% partly blocked 0 0.0% not blocked 34 97.1% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 35 100.0%
split by peak 7 / year
Not applicable: 33No exploit published: 1Protected by Waratek: 1 Low: 1Medium: 11High: 18Critical: 5 not blocked: 34blocked by ARMR today: 1 No public exploit: 35
20031 Not applicable1 High1 not blocked1 No public exploit1 20040 20050 20063 Protected by Waratek1 No exploit published1 Not applicable1 High3 blocked by ARMR today1 not blocked2 No public exploit3 20070 20083 Not applicable3 High1 Medium2 not blocked3 No public exploit3 20090 20100 20112 Not applicable2 Medium2 not blocked2 No public exploit2 20120 20132 Not applicable2 High2 not blocked2 No public exploit2 20141 Not applicable1 Low1 not blocked1 No public exploit1 20150 20161 Not applicable1 High1 not blocked1 No public exploit1 20170 20182 Not applicable2 Medium2 not blocked2 No public exploit2 20192 Not applicable2 Critical1 Medium1 not blocked2 No public exploit2 20202 Not applicable2 High2 not blocked2 No public exploit2 20211 Not applicable1 Medium1 not blocked1 No public exploit1 20223 Not applicable3 High3 not blocked3 No public exploit3 20237 Not applicable7 Critical4 High1 Medium2 not blocked7 No public exploit7 20243 Not applicable3 High2 Medium1 not blocked3 No public exploit3 20250 20262 Not applicable2 High2 not blocked2 No public exploit2
200420062008201020122014201620182020202220242026
35 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-69805 High 2026-09-08 Not applicable No public exploit External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-25193 High 2026-05-25 Not applicable No public exploit Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentials exposure.  Mitigating Factor: Only sites that install Command Centre Services with a custom Service Account (not the default Network Service account) are potentially impacted. Mitigation: For sites concerned about exposure, the recommended action is to change the Service Account password. They can also delete any installer log files, usually found in %programdata%\Gallagher\Command Centre.
CVE-2024-41175 Medium 2024-08-27 Not applicable No public exploit The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local denial-of-service attack by a low privileged attacker.
CVE-2024-41174 High 2024-08-27 Not applicable No public exploit The IPC-Diagnostics package in TwinCAT/BSD is susceptible to improper input neutralization by a low-privileged local attacker.
CVE-2024-41173 High 2024-08-27 Not applicable No public exploit The IPC-Diagnostics package included in TwinCAT/BSD is vulnerable to a local authentication bypass by a low privileged attacker.
CVE-2023-5739 High 2023-10-31 Not applicable No public exploit Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to elevation of privilege.
CVE-2022-3698 Medium 2023-10-25 Not applicable No public exploit A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and  Lenovo Diagnostics versions prior to 4.45 that could allow a local user with administrative access to trigger a system crash.
CVE-2022-0353 Medium 2023-10-25 Not applicable No public exploit A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and  Lenovo Diagnostics versions prior to 4.45 that could allow a local user with administrative access to trigger a system crash.
CVE-2023-32674 Critical 2023-06-12 Not applicable No public exploit Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow.
CVE-2023-32673 Critical 2023-06-12 Not applicable No public exploit Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable to elevation of privilege.
CVE-2023-27497 Critical 2023-04-11 Not applicable No public exploit Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.
CVE-2023-27267 Critical 2023-04-11 Not applicable No public exploit Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitation, the attacker can completely compromise confidentiality, integrity and availability of the system.
CVE-2022-29149 High 2022-06-15 Not applicable No public exploit Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability
CVE-2022-24396 High 2022-03-10 Not applicable No public exploit The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative or other privileged functionalities and read, modify, or delete sensitive information and configurations.
CVE-2022-22547 High 2022-03-10 Not applicable No public exploit Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security exploits.
CVE-2020-12526 Medium 2021-05-13 Not applicable No public exploit TwinCAT OPC UA Server in versions up to 2.3.0.12 and IPC Diagnostics UA Server in versions up to 3.1.0.1 from Beckhoff Automation GmbH & Co. KG are vulnerable to denial of service attacks. The attacker needs to send several specifically crafted requests to the running OPC UA server. After some of these requests the OPC UA server is no longer responsive to any client. This is without effect to the real-time functionality of IPCs.
CVE-2020-5807 High 2020-12-29 Not applicable No public exploit An unauthenticated remote attacker can send data to RsvcHost.exe listening on TCP port 5241 to add entries in the FactoryTalk Diagnostics event log. The attacker can specify long fields in the log entry, which can cause an unhandled exception in wcscpy_s() if a local user opens FactoryTalk Diagnostics Viewer (FTDiagViewer.exe) to view the log entry. Observed in FactoryTalk Diagnostics 6.11. All versions of FactoryTalk Diagnostics are affected.
CVE-2020-8338 High 2020-10-14 Not applicable No public exploit A DLL search path vulnerability was reported in Lenovo Diagnostics prior to version 4.35.4 that could allow a user with local access to execute code on the system.
CVE-2019-0390 Medium 2019-11-13 Not applicable No public exploit Under certain conditions SAP Data Hub (corrected in DH_Foundation version 2) allows an attacker to access information which would otherwise be restricted. Connection details that are maintained in Connection Manager are visible to users.
CVE-2019-0330 Critical 2019-07-10 Not applicable No public exploit The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console of SAP Diagnostic Agent (LM-Service), version 7.2, allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVE-2016-8522 Medium 2018-02-15 Not applicable No public exploit A cross-site scripting vulnerability in HPE Diagnostics version 9.24 IP1, 9.26 , 9.26IP1 was found.
CVE-2016-8521 Medium 2018-02-15 Not applicable No public exploit A Remote click jacking vulnerability in HPE Diagnostics version 9.24 IP1, 9.26 , 9.26IP1 was found.
CVE-2016-3231 High 2016-06-16 Not applicable No public exploit The Standard Collector service in Windows Diagnostics Hub mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Windows Diagnostics Hub Elevation of Privilege Vulnerability."
CVE-2013-6216 Low 2014-04-12 Not applicable No public exploit Unspecified vulnerability in HP Array Configuration Utility, Array Diagnostics Utility, ProLiant Array Diagnostics, and SmartSSD Wear Gauge Utility 9.40 and earlier allows local users to gain privileges via unknown vectors.
CVE-2013-3573 High 2013-06-14 Not applicable No public exploit HP Insight Diagnostics 9.4.0.4710 allows remote attackers to conduct unspecified injection attacks via unknown vectors.
CVE-2012-3278 High 2013-01-25 Not applicable No public exploit Stack-based buffer overflow in magentservice.exe in HP Diagnostics Server 8.x through 8.07 and 9.x through 9.21 allows remote attackers to execute arbitrary code via a malformed message packet.
CVE-2011-2957 Medium 2011-07-28 Not applicable No public exploit Unspecified vulnerability in Rockwell Automation FactoryTalk Diagnostics Viewer before V2.30.00 (CPR9 SR3) allows local users to execute arbitrary code via a crafted FactoryTalk Diagnostics Viewer (.ftd) configuration file, which triggers memory corruption.
CVE-2011-0892 Medium 2011-03-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in HP Diagnostics 7.5x and 8.0x before 8.05.54.225 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
CVE-2008-3542 High 2008-10-02 Not applicable No public exploit Unspecified vulnerability in HP Insight Diagnostics before 7.9.1.2402 allows remote attackers to read arbitrary files via unknown vectors.
CVE-2008-1438 Medium 2008-05-13 Not applicable No public exploit Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (disk space exhaustion) via a file with "crafted data structures" that trigger the creation of large temporary files, a different vulnerability than CVE-2008-1437.
CVE-2008-1437 Medium 2008-05-13 Not applicable No public exploit Unspecified vulnerability in Microsoft Malware Protection Engine (mpengine.dll) 1.1.3520.0 and 0.1.13.192, as used in multiple Microsoft products, allows context-dependent attackers to cause a denial of service (engine hang and restart) via a crafted file, a different vulnerability than CVE-2008-1438.
CVE-2006-1037 High 2006-03-07 Protected by Waratek No public exploit SQL injection vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.
CVE-2006-1036 High 2006-03-07 Not applicable No public exploit Multiple unspecified vulnerabilities in the Oracle Diagnostics module 2.2 and earlier have unknown impact and attack vectors, related to "permissions."
CVE-2006-1035 High 2006-03-07 No exploit published No public exploit Unspecified vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to access diagnostics tests via unknown attack vectors.
CVE-2003-1495 High 2003-12-31 Not applicable No public exploit Unspecified vulnerability in the non-SSL web agent in various HP Management Agent products allows local users or remote attackers to gain privileges or cause a denial of service via unknown attack vectors.