WaratekVRT Sign in
Reset
More filters (1)
Columns
Published from 2020-03-01✕
Overview 107 matches · 23 protected · 0 exploited · 0 CISA KEV · 34 EPSS ≥ 0.5
107matches 23protected21.5% 0exploited0.0% 0CISA KEV0.0% 34EPSS ≥ 0.531.8%
Protected by Waratek 23 21.5% Rule in development 2 1.9% Mitigation candidate 82 76.6% No exploit published 0 0.0%
Critical 26 24.3% High 35 32.7% Medium 45 42.1% Low 1 0.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 23 21.5% partly blocked 0 0.0% not blocked 84 78.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 107 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 27 / year
Mitigation candidate: 82Rule in development: 2Protected by Waratek: 23 Low: 1Medium: 45High: 35Critical: 26 not blocked: 84blocked by ARMR today: 23 Working exploit published: 107
202016 Protected by Waratek5 Mitigation candidate11 Critical1 High6 Medium9 blocked by ARMR today5 not blocked11 Working exploit published16 202113 Protected by Waratek4 Rule in development1 Mitigation candidate8 Critical3 High4 Medium6 blocked by ARMR today4 not blocked9 Working exploit published13 202211 Protected by Waratek4 Mitigation candidate7 Critical3 High5 Medium3 blocked by ARMR today4 not blocked7 Working exploit published11 202327 Protected by Waratek2 Mitigation candidate25 Critical10 High9 Medium8 blocked by ARMR today2 not blocked25 Working exploit published27 202414 Protected by Waratek2 Mitigation candidate12 Critical4 High6 Medium3 Low1 blocked by ARMR today2 not blocked12 Working exploit published14 202512 Protected by Waratek3 Rule in development1 Mitigation candidate8 Critical2 High1 Medium9 blocked by ARMR today3 not blocked9 Working exploit published12 202614 Protected by Waratek3 Mitigation candidate11 Critical3 High4 Medium7 blocked by ARMR today3 not blocked11 Working exploit published14
2020202120222023202420252026
107 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2020-13935 High 2020-07-14 Mitigation candidate Working exploit published The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
CVE-2020-9484 High 2020-05-20 Protected by Waratek Working exploit published When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
CVE-2020-7656 Medium 2020-05-19 Protected by Waratek Working exploit published jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
CVE-2020-2733 Critical 2020-04-15 Mitigation candidate Working exploit published Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2020-10204 High 2020-04-01 Mitigation candidate Working exploit published Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.
CVE-2020-2140 Medium 2020-03-09 Mitigation candidate Working exploit published Jenkins Audit Trail Plugin 3.2 and earlier does not escape the error message for the URL Patterns field form validation, resulting in a reflected cross-site scripting vulnerability.
CVE-2020-5405 Medium 2020-03-05 Protected by Waratek Working exploit published Spring Cloud Config, versions 2.2.x prior to 2.2.2, versions 2.1.x prior to 2.1.7, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead a directory traversal attack.
‹ prev page 2 of 2 next ›