oncommand api services CVEs · Protected by Waratek · No public exploit

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

3matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%

Critical 2 66.7% High 1 33.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 100.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Sep 191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Oct 190 Nov 190 Dec 190 Jan 200 Feb 200 Mar 200 Apr 200 May 201 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Jun 200 Jul 200 Aug 200 Sep 200 Oct 200 Nov 200 Dec 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1

Oct 19Dec 19Feb 20Apr 20Jun 20Aug 20Oct 20Dec 20

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2020-25649	High	2020-12-03	Protected by Waratek	No public exploit	A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVE-2020-10683	Critical	2020-05-01	Protected by Waratek	No public exploit	dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
CVE-2019-16335	Critical	2019-09-15	Protected by Waratek	No public exploit	A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2020-25649

High

2020-12-03

Protected by Waratek

No public exploit

A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

CVE-2020-10683

Critical

2020-05-01

Protected by Waratek

No public exploit

dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.

CVE-2019-16335

Critical

2019-09-15

Protected by Waratek

No public exploit

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.