WaratekVRT Sign in

High Virtualization CVEs with no public exploit

8 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Product virtualization✕
Overview 8 matches · 3 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
8matches 3protected37.5% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 3 37.5% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 62.5%
Critical 0 0.0% High 8 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 37.5% partly blocked 0 0.0% not blocked 5 62.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 8 100.0%
split by peak 2 / quarter
No exploit published: 5Protected by Waratek: 3 High: 8 not blocked: 5blocked by ARMR today: 3 No public exploit: 8
Q2 151 No exploit published1 High1 not blocked1 No public exploit1 Q3 150 Q4 150 Q1 160 Q2 160 Q3 160 Q4 160 Q1 170 Q2 170 Q3 170 Q4 170 Q1 182 Protected by Waratek2 High2 blocked by ARMR today2 No public exploit2 Q2 182 No exploit published2 High2 not blocked2 No public exploit2 Q3 181 No exploit published1 High1 not blocked1 No public exploit1 Q4 180 Q1 191 No exploit published1 High1 not blocked1 No public exploit1 Q2 190 Q3 191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Q3 15Q1 16Q3 16Q1 17Q3 17Q1 18Q3 18Q1 19Q3 19
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-10086 High 2019-08-20 Protected by Waratek No public exploit In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVE-2019-3879 High 2019-03-25 No exploit published No public exploit It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.
CVE-2017-15113 High 2018-07-27 No exploit published No public exploit ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.
CVE-2018-1000180 High 2018-06-05 No exploit published No public exploit Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appears to be fixed in versions BC 1.60 beta 4 and later, BC-FJA 1.0.2 and later.
CVE-2018-1074 High 2018-04-26 No exploit published No public exploit ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.
CVE-2018-5968 High 2018-01-22 Protected by Waratek No public exploit FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
CVE-2017-7536 High 2018-01-10 Protected by Waratek No public exploit In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
CVE-2014-0230 High 2015-06-07 No exploit published No public exploit Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.55, and 8.x before 8.0.9 does not properly handle cases where an HTTP response occurs before finishing the reading of an entire request body, which allows remote attackers to cause a denial of service (thread consumption) via a series of aborted upload attempts.