Overview 4 matches · 3 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
4matches
3in Waratek scope75.0%
1protected25.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
25.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
2
50.0%
Outside Waratek scope
0
0.0%
Not applicable
1
25.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
25.0%
partly blocked
0
0.0%
not blocked
3
75.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
4
100.0%
split by
peak 1 / month
Mar 231
Not applicable1
Medium1
not blocked1
No public exploit1
Apr 230
May 230
Jun 230
Jul 231
Protected by Waratek1
Critical1
blocked by ARMR today1
No public exploit1
Aug 230
Sep 231
No exploit published1
High1
not blocked1
No public exploit1
Oct 230
Nov 230
Dec 231
No exploit published1
High1
not blocked1
No public exploit1
Mar 23Apr 23May 23Jun 23Jul 23Aug 23Sep 23Oct 23Nov 23Dec 23
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-6563 | High | 2023-12-14 | No exploit published | No public exploit | An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system. |
| CVE-2023-3223 | High | 2023-09-27 | No exploit published | No public exploit | A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit the file size, it's possible to bypass the limit by setting the file name in the request to null. |
| CVE-2022-4361 | Critical | 2023-07-07 | Protected by Waratek | No public exploit | Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri. |
| CVE-2023-0056 | Medium | 2023-03-23 | Not applicable | No public exploit | An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability. |