Overview 51 matches · 3 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
Protected by Waratek
2
3.9%
Rule in development
0
0.0%
Mitigation candidate
1
2.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
48
94.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
3.9%
partly blocked
0
0.0%
not blocked
49
96.1%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
51
100.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 11 / year
20021
Not applicable1
High1
not blocked1
Working exploit published1
20030
20041
Not applicable1
Medium1
not blocked1
Working exploit published1
20050
20066
Not applicable6
High3
Medium3
not blocked6
Working exploit published6
200711
Not applicable11
High8
Medium3
not blocked11
Working exploit published11
20083
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20095
Not applicable5
High5
not blocked5
Working exploit published5
20103
Not applicable3
High3
not blocked3
Working exploit published3
20112
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20121
Not applicable1
Medium1
not blocked1
Working exploit published1
20130
20140
20153
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20160
20175
Protected by Waratek1
Mitigation candidate1
Not applicable3
Critical1
High4
blocked by ARMR today1
not blocked4
Working exploit published5
20183
Protected by Waratek1
Not applicable2
Critical2
Medium1
blocked by ARMR today1
not blocked2
Working exploit published3
20192
Not applicable2
Critical1
Medium1
not blocked2
Working exploit published2
20200
20211
Not applicable1
Medium1
not blocked1
Working exploit published1
20222
Not applicable2
High2
not blocked2
Working exploit published2
20230
20241
Not applicable1
Critical1
not blocked1
Working exploit published1
20251
Not applicable1
High1
not blocked1
Working exploit published1
200320052007200920112013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-13624 | High | 2025-02-26 | Not applicable | Working exploit published | The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. |
| CVE-2024-5450 | Critical | 2024-07-13 | Not applicable | Working exploit published | The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files |
| CVE-2021-45027 | High | 2022-09-01 | Not applicable | Working exploit published | An arbitrary file download vulnerability in Oliver v5 Library Server Versions < 5.00.008.053 via the FileServlet function allows for arbitrary file download by an attacker using unsanitized user supplied input. |
| CVE-2021-45793 | High | 2022-03-17 | Not applicable | Working exploit published | Slims9 Bulian 9.4.2 is affected by SQL injection in lib/comment.inc.php. User data can be obtained. |
| CVE-2021-38314 | Medium | 2021-09-02 | Not applicable | Working exploit published | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but deterministic and predictable given that they were based on an md5 hash of the site URL with a known salt value of '-redux' and an md5 hash of the previous hash with a known salt value of '-support'. These AJAX actions could be used to retrieve a list of active plugins and their versions, the site's PHP version, and an unsalted md5 hash of site’s `AUTH_KEY` concatenated with the `SECURE_AUTH_KEY`. |
| CVE-2019-19245 | Critical | 2019-12-02 | Not applicable | Working exploit published | NAPC Xinet Elegant 6 Asset Library 6.1.655 allows Pre-Authentication SQL Injection via the /elegant6/login LoginForm[username] field when double quotes are used. |
| CVE-2019-18957 | Medium | 2019-11-14 | Not applicable | Working exploit published | Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS. |
| CVE-2018-1271 | Medium | 2018-04-06 | Protected by Waratek | Working exploit published | Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to configure Spring MVC to serve static resources (e.g. CSS, JS, images). When static resources are served from a file system on Windows (as opposed to the classpath, or the ServletContext), a malicious user can send a request using a specially crafted URL that can lead a directory traversal attack. |
| CVE-2018-7312 | Critical | 2018-02-22 | Not applicable | Working exploit published | SQL Injection exists in the Alexandria Book Library 3.1.2 component for Joomla! via the letter parameter. |
| CVE-2018-5971 | Critical | 2018-02-17 | Not applicable | Working exploit published | SQL Injection exists in the MediaLibrary Free 4.0.12 component for Joomla! via the id parameter or the mid array parameter. |
| CVE-2017-11567 | High | 2017-09-07 | Not applicable | Working exploit published | Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely. |
| CVE-2015-3314 | High | 2017-09-07 | Not applicable | Working exploit published | SQL injection vulnerability in WordPress Tune Library plugin before 1.5.5. |
| CVE-2017-10246 | High | 2017-08-08 | Mitigation candidate | Working exploit published | Vulnerability in the Oracle Application Object Library component of Oracle E-Business Suite (subcomponent: iHelp). Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Application Object Library accessible data as well as unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data. CVSS 3.0 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). |
| CVE-2017-5645 | Critical | 2017-04-17 | Protected by Waratek | Working exploit published | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. |
| CVE-2017-7185 | High | 2017-04-10 | Not applicable | Working exploit published | Use-after-free vulnerability in the mg_http_multipart_wait_for_boundary function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.7 and earlier and Mongoose OS 1.2 and earlier allows remote attackers to cause a denial of service (crash) via a multipart/form-data POST request without a MIME boundary string. |
| CVE-2014-100031 | High | 2015-01-13 | Not applicable | Working exploit published | Multiple SQL injection vulnerabilities in Ganesha Digital Library (GDL) 4.2 allow remote attackers to execute arbitrary SQL commands via the id parameter in (1) download.php or (2) main.php. |
| CVE-2014-100030 | Medium | 2015-01-13 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in module/search/function.php in Ganesha Digital Library (GDL) 4.2 allows remote attackers to inject arbitrary web script or HTML via the keyword parameter in a ByEge action. |
| CVE-2014-100029 | Medium | 2015-01-13 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in class/session.php in Ganesha Digital Library (GDL) 4.2 allow remote attackers to read arbitrary files via a .. (dot dot) in the (1) newlang or (2) newtheme parameter. |
| CVE-2012-0007 | Medium | 2012-01-10 | Not applicable | Working exploit published | The Microsoft Anti-Cross Site Scripting (AntiXSS) Library 3.x and 4.0 does not properly evaluate characters after the detection of a Cascading Style Sheets (CSS) escaped character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via HTML input, aka "AntiXSS Library Bypass Vulnerability." |
| CVE-2010-5021 | High | 2011-11-02 | Not applicable | Working exploit published | SQL injection vulnerability in view_group.asp in Digital Interchange Document Library 5.8.5 allows remote attackers to execute arbitrary SQL commands via the intGroupID parameter. |
| CVE-2011-1425 | Medium | 2011-04-04 | Not applicable | Working exploit published | xslt.c in XML Security Library (aka xmlsec) before 1.2.17, as used in WebKit and other products, when XSLT is enabled, allows remote attackers to create or overwrite arbitrary files via vectors involving the libxslt output extension and a ds:Transform element during signature verification. |
| CVE-2009-4806 | High | 2010-04-23 | Not applicable | Working exploit published | admin/save_user.asp in Digital Interchange Document Library 1.0.1 does not require administrative authentication, which allows remote attackers to read or modify the administrator's credentials via unspecified vectors. NOTE: some of these details are obtained from third party information. |
| CVE-2009-4735 | High | 2010-03-18 | Not applicable | Working exploit published | SQL injection vulnerability in login.php in Allomani Audio & Video Library (Songs & Clips version) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action. |
| CVE-2009-4734 | High | 2010-03-18 | Not applicable | Working exploit published | SQL injection vulnerability in login.php in Allomani Movies Library (Movies & Clips) 2.7.0 allows remote attackers to execute arbitrary SQL commands via the username parameter in a login action. |
| CVE-2009-3817 | High | 2009-10-28 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in doc/releasenote.php in the BookLibrary (com_booklibrary) component 1.0 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter, a different vector than CVE-2009-2637. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2009-2637 | High | 2009-07-28 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in toolbar_ext.php in the BookLibrary (com_booklibrary) component 1.5.2.4 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. |
| CVE-2009-2634 | High | 2009-07-28 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in toolbar_ext.php in the MediaLibrary (com_media_library) component 1.5.3 Basic for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter. |
| CVE-2009-0965 | High | 2009-03-19 | Not applicable | Working exploit published | SQL injection vulnerability in functions/browse.php in Ganesha Digital Library (GDL) 4.0 and 4.2 allows remote attackers to execute arbitrary SQL commands via the node parameter in a browse action to gdl.php. |
| CVE-2009-0428 | High | 2009-02-05 | Not applicable | Working exploit published | SQL injection vulnerability in CategoryManager/upload_image_category.asp in DMXReady Secure Document Library 1.1 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter. |
| CVE-2008-1069 | Medium | 2008-02-28 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in Quantum Game Library 0.7.2c allow remote attackers to execute arbitrary PHP code via a URL in the CONFIG[gameroot] parameter to (1) server_request.php and (2) qlib/smarty.inc.php. |
| CVE-2008-0545 | High | 2008-02-01 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to include and execute arbitrary local files via a .. (dot dot) in the (1) uri parameter to (a) yui-menu.tpl.php, (b) simple.tpl.php, and (c) advanced.tpl.php in dispatcher/framework/; and the (2) page parameter to (d) yui-menu.php, (e) simple.php, and (f) advanced.php in dispatcher/framework/, different vectors than CVE-2008-0521. |
| CVE-2008-0521 | Medium | 2008-01-31 | Not applicable | Working exploit published | Multiple directory traversal vulnerabilities in Bubbling Library 1.32 allow remote attackers to read arbitrary files via a .. (dot dot) in the uri parameter to dispatcher.php in (1) examples/dispatcher/framework/, (2) examples/dispatcher/, (3) examples/wizard/, and (4) PHP/, different vectors than CVE-2008-0545. |
| CVE-2007-4738 | High | 2007-09-06 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the (1) db_conf or (2) ADODB_DIR parameter to utils/stphpimage_show.php; or a URL in the STPHPLIB_DIR parameter to (3) stphpbutton.php, (4) stphpcheckbox.php, (5) stphpcheckboxwithcaption.php, (6) stphpcheckgroup.php, (7) stphpcomponent.php, (8) stphpcontrolwithcaption.php, (9) stphpedit.php, (10) stphpeditwithcaption.php, (11) stphphr.php, (12) stphpimage.php, (13) stphpimagewithcaption.php, (14) stphplabel.php, (15) stphplistbox.php, (16) stphplistboxwithcaption.php, (17) stphplocale.php, (18) stphppanel.php, (19) stphpradiobutton.php, (20) stphpradiobuttonwithcaption.php, (21) stphpradiogroup.php, (22) stphprichbutton.php, (23) stphpspacer.php, (24) stphptable.php, (25) stphptablecell.php, (26) stphptablerow.php, (27) stphptabpanel.php, (28) stphptabtitle.php, (29) stphptextarea.php, (30) stphptextareawithcaption.php, (31) stphptoolbar.php, (32) stphpwindow.php, (33) stphpxmldoc.php, or (34) stphpxmlelement.php, a different set of vectors than CVE-2007-4737. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2007-4737 | High | 2007-09-06 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library (STPHPLibrary) 0.8.0 allow remote attackers to execute arbitrary PHP code via a URL in the STPHPLIB_DIR parameter to (1) stphpapplication.php, (2) stphpbtnimage.php, or (3) stphpform.php. |
| CVE-2007-4341 | High | 2007-08-14 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in adm/my_statistics.php in Omnistar Lib2 PHP 0.2 allows remote attackers to execute arbitrary PHP code via a URL in the DOCUMENT_ROOT parameter. |
| CVE-2007-3569 | Medium | 2007-07-05 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in Oliver Library Management System allow remote attackers to inject arbitrary web script or HTML via the (1) updateform and (2) displayform parameter to (a) gateway/gateway.exe; the (3) TERMS, (4) database, (5) srchad, (6) SuggestedSearch, and (7) searchform parameters to the (b) "Basic Search page"; and (8) username parameter when (c) logging on. |
| CVE-2007-3473 | Medium | 2007-06-28 | Not applicable | Working exploit published | The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. |
| CVE-2007-2981 | High | 2007-06-01 | Not applicable | Working exploit published | Buffer overflow in a certain ActiveX control in LEAD Technologies LEADTOOLS Raster OCR Document Object Library (ltrdc14e.dll) 14.5.0.44 allows remote attackers to execute arbitrary code via a long DictionaryFileName property. |
| CVE-2007-2851 | High | 2007-05-24 | Not applicable | Working exploit published | A certain ActiveX control in LeadTools Raster Variant Object Library (LTRVR14e.dll) 14.5.0.44 allows remote attackers to overwrite arbitrary files via the WriteDataToFile method. |
| CVE-2007-2787 | High | 2007-05-21 | Not applicable | Working exploit published | Stack-based buffer overflow in the BrowseDir function in the (1) lttmb14E.ocx or (2) LTRTM14e.DLL ActiveX control in LeadTools Raster Thumbnail Object Library 14.5.0.44 allows remote attackers to execute arbitrary code via a long argument. |
| CVE-2007-2660 | Medium | 2007-05-14 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in pcltrace.lib.php in the PclTar module in Vincent Blavet PhpConcept Library, as used in CJG EXPLORER PRO 3.3 and earlier and probably other products, allows remote attackers to execute arbitrary PHP code via a URL in the g_pcltar_lib_dir parameter. NOTE: CVE disputes this issue since there is no include statement in pcltrace.lib.php. NOTE: the pcltar.lib.php vector is already covered by CVE-2007-2199 |
| CVE-2007-1815 | High | 2007-04-02 | Not applicable | Working exploit published | SQL injection vulnerability in viewcat.php in the Library module for Xoops allows remote attackers to execute arbitrary SQL commands via the cid parameter. |
| CVE-2007-0584 | High | 2007-01-30 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neric) allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter. |
| CVE-2006-5472 | High | 2006-10-24 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the lib_dir parameter in (1) lib/registry.lib.php, (2) lib/sqlcompose.lib.php, and (3) lib/sqlsearch.lib.php. |
| CVE-2006-5471 | High | 2006-10-24 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in example/lib/grid3.lib.php in Softerra PHP Developer Library 1.5.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the (1) cfg_dir and (2) lib_dir parameters. |
| CVE-2006-3086 | High | 2006-06-19 | Not applicable | Working exploit published | Stack-based buffer overflow in the HrShellOpenWithMonikerDisplayName function in Microsoft Hyperlink Object Library (hlink.dll) allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long hyperlink, as demonstrated using an Excel worksheet with a long link in Unicode, aka "Hyperlink COM Object Buffer Overflow Vulnerability." NOTE: this is a different issue than CVE-2006-3059. |
| CVE-2006-2906 | Medium | 2006-06-08 | Not applicable | Working exploit published | The LZW decoding in the gdImageCreateFromGifPtr function in the Thomas Boutell graphics draw (GD) library (aka libgd) 2.0.33 allows remote attackers to cause a denial of service (CPU consumption) via malformed GIF data that causes an infinite loop. |
| CVE-2006-2297 | Medium | 2006-05-10 | Not applicable | Working exploit published | Heap-based buffer overflow in Microsoft Infotech Storage System Library (itss.dll) allows user-assisted attackers to execute arbitrary code via a crafted CHM / ITS file that triggers the overflow while decompiling. |
| CVE-2006-1194 | Medium | 2006-03-13 | Not applicable | Working exploit published | Integer signedness error in the enet_protocol_handle_incoming_commands function in protocol.c for ENet library CVS version Jul 2005 and earlier, as used in products including (1) Cube, (2) Sauerbraten, and (3) Duke3d_w32, allows remote attackers to cause a denial of service (application crash) via a packet with a large command length value, which leads to an invalid memory access. |
| CVE-2004-1746 | Medium | 2004-12-31 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.php in PHP Code Snippet Library allows remote attackers to inject arbitrary web script or HTML via the (1) cat_select or (2) show parameters. |
| CVE-2002-1973 | High | 2002-12-31 | Not applicable | Working exploit published | Buffer overflow in CHttpServer::OnParseError in the ISAPI extension (Isapi.cpp) when built using Microsoft Foundation Class (MFC) static libraries in Visual C++ 5.0, and 6.0 before SP3, as used in multiple products including BadBlue, allows remote attackers to cause a denial of service (access violation and crash) and possibly execute arbitrary code via a long query string that causes a parsing error. |