WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product fuse✕
Overview 16 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
16matches 1in Waratek scope6.2% 1protected6.2% 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.56.2%
Protected by Waratek 1 6.2% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 15 93.8% Withdrawn CVE 0 0.0%
Critical 1 6.2% High 6 37.5% Medium 7 43.8% Low 2 12.5% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 6.2% partly blocked 0 0.0% not blocked 15 93.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 16 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 15Protected by Waratek: 1 Low: 2Medium: 7High: 6Critical: 1 not blocked: 15blocked by ARMR today: 1 Working exploit published: 16
19991 Not applicable1 High1 not blocked1 Working exploit published1 20000 20011 Not applicable1 Medium1 not blocked1 Working exploit published1 20022 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20030 20041 Not applicable1 Medium1 not blocked1 Working exploit published1 20052 Not applicable2 Medium1 Low1 not blocked2 Working exploit published2 20060 20072 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20081 Not applicable1 High1 not blocked1 Working exploit published1 20090 20100 20112 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20121 Not applicable1 Medium1 not blocked1 Working exploit published1 20130 20140 20151 Not applicable1 Low1 not blocked1 Working exploit published1 20160 20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20181 Not applicable1 High1 not blocked1 Working exploit published1
2000200220042006200820102012201420162018
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2018-10906 High 2018-07-24 Not applicable Working exploit published In fuse before versions 2.9.8 and 3.x before 3.2.5, fusermount is vulnerable to a restriction bypass when SELinux is active. This allows non-root users to mount a FUSE file system with the 'allow_other' mount option regardless of whether 'user_allow_other' is set in the fuse configuration. An attacker may use this flaw to mount a FUSE file system, accessible by other users, and trick them into accessing files on that file system, possibly causing Denial of Service or other unspecified effects.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2015-3202 Low 2015-07-02 Not applicable Working exploit published fusermount in FUSE before 2.9.3-15 does not properly clear the environment before invoking (1) mount or (2) umount as root, which allows local users to write to arbitrary files via a crafted LIBMOUNT_MTAB environment variable that is used by mount's debugging feature.
CVE-2012-5295 Medium 2012-10-04 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in login.cfm in FuseTalk Forums 3.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the windowed parameter.
CVE-2010-5033 High 2011-11-02 Not applicable Working exploit published SQL injection vulnerability in ProductList.cfm in Fusebox 5.5.1 allows remote attackers to execute arbitrary SQL commands via the CatDisplay parameter.
CVE-2010-3879 Medium 2011-01-22 Not applicable Working exploit published FUSE, possibly 2.8.5 and earlier, allows local users to create mtab entries with arbitrary pathnames, and consequently unmount any filesystem, via a symlink attack on the parent directory of the mountpoint of a FUSE filesystem, a different vulnerability than CVE-2010-0789.
CVE-2008-2284 High 2008-05-18 Not applicable Working exploit published PHP remote file inclusion vulnerability in fusebox5.php in Fusebox 5.5.1 allows remote attackers to execute arbitrary PHP code via a URL in the FUSEBOX_APPLICATION_PATH parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2007-3339 Medium 2007-06-21 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in forum/include/error/autherror.cfm in FuseTalk Basic, Standard, Enterprise, and ColdFusion allow remote attackers to inject arbitrary web script or HTML via the (1) FTVAR_LINKP and (2) FTVAR_URLP parameters to (a) forum/include/error/autherror.cfm, and the (3) FTVAR_SCRIPTRUN parameter to (b) forum/include/common/comfinish.cfm and (c) blog/include/common/comfinish.cfm.
CVE-2007-3301 High 2007-06-20 Not applicable Working exploit published SQL injection vulnerability in forum/include/error/autherror.cfm in FuseTalk allows remote attackers to execute arbitrary SQL commands via the errorcode parameter. NOTE: a patch may have been released privately between April and June 2007. NOTE: this issue may overlap CVE-2007-3273.
CVE-2005-2480 Medium 2005-08-05 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in ColdFusion Fusebox 4.1.0 allows remote attackers to inject arbitrary web script or HTML via the fuseaction parameter, which is not quoted in an error page, as demonstrated using index.cfm.
CVE-2005-1858 Low 2005-06-03 Not applicable Working exploit published FUSE 2.x before 2.3.0 does not properly clear previously used memory from unfilled pages when the filesystem returns a short byte count to a read request, which may allow local users to obtain sensitive information.
CVE-2004-1995 Medium 2004-12-31 Not applicable Working exploit published Cross-Site Request Forgery (CSRF) vulnerability in FuseTalk 2.0 allows remote attackers to create arbitrary accounts via a link to adduser.cfm.
CVE-2002-0504 High 2002-08-12 Not applicable Working exploit published Cross-site scripting vulnerability in Citrix NFuse 1.6 and earlier does not quote results from the getLastError method, which allows remote attackers to execute script in other clients via the NFuse_Application parameter to (1) launch.jsp or (2) launch.asp.
CVE-2002-0502 Medium 2002-08-12 Not applicable Working exploit published Citrix NFuse 1.6 may allow remote attackers to list applications without authentication by accessing the applist.asp page.
CVE-2001-0760 Medium 2001-10-18 Not applicable Working exploit published Citrix Nfuse 1.51 allows remote attackers to obtain the absolute path of the web root via a malformed request to launch.asp that does not provide the session field.
CVE-1999-0759 High 1999-09-13 Not applicable Working exploit published Buffer overflow in FuseMAIL POP service via long USER and PASS commands.