Overview 12 matches · 2 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
Protected by Waratek
2
16.7%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
10
83.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
16.7%
partly blocked
0
0.0%
not blocked
10
83.3%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
12
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 4 / year
20111
Not applicable1
Medium1
not blocked1
Working exploit published1
20121
Not applicable1
Medium1
not blocked1
Working exploit published1
20130
20144
Not applicable4
High1
Medium3
not blocked4
Working exploit published4
20150
20160
20171
Protected by Waratek1
Critical1
blocked by ARMR today1
Working exploit published1
20182
Protected by Waratek1
Not applicable1
High1
Medium1
blocked by ARMR today1
not blocked1
Working exploit published2
20190
20200
20210
20222
Not applicable2
High2
not blocked2
Working exploit published2
20231
Not applicable1
High1
not blocked1
Working exploit published1
2011201320152017201920212023
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-5003 | High | 2023-10-16 | Not applicable | Working exploit published | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. Unfortunately, this log file is never removed, and remains accessible to any users knowing the URL to do so. |
| CVE-2022-2334 | High | 2022-08-17 | Not applicable | Working exploit published | The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22. |
| CVE-2022-1373 | High | 2022-08-17 | Not applicable | Working exploit published | The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore configuration" feature to upload a zip file containing a path traversal file may cause a file to be created and executed upon touching the disk. |
| CVE-2018-8880 | High | 2018-04-23 | Not applicable | Working exploit published | Lutron Quantum BACnet Integration 2.0 (firmware 3.2.243) doesn't check for correct user authentication before showing the /deviceIP information, which leads to internal network information disclosure. |
| CVE-2018-1271 | Medium | 2018-04-06 | Protected by Waratek | Working exploit published | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack. |
| CVE-2017-5645 | Critical | 2017-04-17 | Protected by Waratek | Working exploit published | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. |
| CVE-2014-1908 | Medium | 2014-12-29 | Not applicable | Working exploit published | The error-handling feature in (1) bp.php, (2) videowhisper_streaming.php, and (3) ls/rtmp.inc.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to obtain sensitive information via a direct request, which reveals the full path in an error message. |
| CVE-2014-1905 | High | 2014-12-29 | Not applicable | Working exploit published | Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension, and then accessing the file via a direct request to a wp-content/plugins/videowhisper-live-streaming-integration/ls/snapshots/ pathname, as demonstrated by a .php.jpg filename. |
| CVE-2014-1907 | Medium | 2014-03-06 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to (1) read arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_login.php or (2) delete arbitrary files via a .. (dot dot) in the s parameter to ls/rtmp_logout.php. |
| CVE-2014-1906 | Medium | 2014-03-06 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in the VideoWhisper Live Streaming Integration plugin before 4.29.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) m parameter to lb_status.php; (2) msg parameter to vc_chatlog.php; n parameter to (3) channel.php, (4) htmlchat.php, (5) video.php, or (6) videotext.php; (7) message parameter to lb_logout.php; or ct parameter to (8) lb_status.php or (9) v_status.php in ls/. |
| CVE-2011-5179 | Medium | 2012-09-20 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in skysa-official/skysa.php in Skysa App Bar Integration plugin, possibly before 1.04, for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter. |
| CVE-2011-2007 | Medium | 2011-10-12 | Not applicable | Working exploit published | Microsoft Host Integration Server (HIS) 2004 SP1, 2006 SP1, 2009, and 2010 allows remote attackers to cause a denial of service (SNA Server service outage) via crafted TCP or UDP traffic, aka "Endless Loop DoS in snabase.exe Vulnerability." |