WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2011-07-01✕Product application server✕
Overview 5 matches · 3 protected · 0 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5
5matches 3protected60.0% 0exploited0.0% 0CISA KEV0.0% 2EPSS ≥ 0.540.0%
Protected by Waratek 3 60.0% Rule in development 0 0.0% Mitigation candidate 2 40.0% No exploit published 0 0.0%
Critical 2 40.0% High 1 20.0% Medium 2 40.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 60.0% partly blocked 0 0.0% not blocked 2 40.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 5 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / year
Mitigation candidate: 2Protected by Waratek: 3 Medium: 2High: 1Critical: 2 not blocked: 2blocked by ARMR today: 3 Working exploit published: 5
20111 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20120 20130 20140 20150 20161 Mitigation candidate1 High1 not blocked1 Working exploit published1 20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20181 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20191 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1
201120122013201420152016201720182019
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-4279 Critical 2019-05-17 Protected by Waratek Working exploit published IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources. IBM X-Force ID: 160445.
CVE-2018-1271 Medium 2018-04-06 Protected by Waratek Working exploit published Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2016-0793 High 2016-04-01 Mitigation candidate Working exploit published Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters.
CVE-2010-3271 Medium 2011-07-18 Mitigation candidate Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in the Integrated Solutions Console (aka administrative console) in IBM WebSphere Application Server (WAS) 7.0.0.13 and earlier allow remote attackers to hijack the authentication of administrators for requests that disable certain security options via an Edit action to console/adminSecurityDetail.do followed by a save action to console/syncworkspace.do.