WaratekVRT Sign in
Reset
More filters (1)
Columns
Product tics✕
Overview 17 matches · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
17matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 17 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 6 35.3% High 8 47.1% Medium 3 17.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 17 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 17 100.0%
split by peak 5 / year
Protected by Waratek: 17 Medium: 3High: 8Critical: 6 blocked by ARMR today: 17 No public exploit: 17
20061 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20183 Protected by Waratek3 Critical2 Medium1 blocked by ARMR today3 No public exploit3 20195 Protected by Waratek5 Critical3 High1 Medium1 blocked by ARMR today5 No public exploit5 20201 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20210 20220 20235 Protected by Waratek5 High4 Medium1 blocked by ARMR today5 No public exploit5 20241 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20250 20261 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
20062008201020122014201620182020202220242026
17 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-2253 High 2026-05-27 Protected by Waratek No public exploit Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.
CVE-2024-28982 High 2024-06-26 Protected by Waratek No public exploit Hitachi Vantara Pentaho Business Analytics Server versions before 10.1.0.0 and 9.3.0.7, including 8.3.x do not correctly protect the ACL service endpoint of the Pentaho User Console against XML External Entity Reference.
CVE-2023-6836 High 2023-12-15 Protected by Waratek No public exploit Multiple WSO2 products have been identified as vulnerable due to an XML External Entity (XXE) attack abuses a widely available but rarely used feature of XML parsers to access sensitive information.
CVE-2023-46674 High 2023-12-05 Protected by Waratek No public exploit An issue was identified that allowed the unsafe deserialization of java objects from hadoop or spark configuration properties that could have been modified by authenticated users. Elastic would like to thank Yakov Shafranovich, with Amazon Web Services for reporting this issue.
CVE-2022-4815 High 2023-05-24 Protected by Waratek No public exploit Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. 
CVE-2022-43941 High 2023-04-03 Protected by Waratek No public exploit Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x do not correctly protect the Post Analysis service endpoint of the data access plugin against out-of-band XML External Entity Reference. 
CVE-2022-43771 Medium 2023-04-03 Protected by Waratek No public exploit Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.  
CVE-2020-10683 Critical 2020-05-01 Protected by Waratek No public exploit dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
CVE-2019-10219 Medium 2019-11-08 Protected by Waratek No public exploit A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
CVE-2019-16335 Critical 2019-09-15 Protected by Waratek No public exploit A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVE-2019-10086 High 2019-08-20 Protected by Waratek No public exploit In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVE-2019-14379 Critical 2019-07-29 Protected by Waratek No public exploit SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVE-2018-11307 Critical 2019-07-09 Protected by Waratek No public exploit An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows exfiltration of content. Fixed in 2.7.9.4, 2.8.11.2, and 2.9.6.
CVE-2018-17247 Medium 2018-12-20 Protected by Waratek No public exploit Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.
CVE-2018-8088 Critical 2018-03-20 Protected by Waratek No public exploit org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
CVE-2017-15095 Critical 2018-02-06 Protected by Waratek No public exploit A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CVE-2006-1037 High 2006-03-07 Protected by Waratek No public exploit SQL injection vulnerability in the Oracle Diagnostics module 2.2 and earlier allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.