WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product monitoring✕
Overview 20 matches · 5 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 5 EPSS ≥ 0.5
20matches 5in Waratek scope25.0% 2protected10.0% 0exploited0.0% 0CISA KEV0.0% 5EPSS ≥ 0.525.0%
Protected by Waratek 2 10.0% Rule in development 0 0.0% Mitigation candidate 3 15.0% No exploit published 0 0.0% Outside Waratek scope 2 10.0% Not applicable 13 65.0% Withdrawn CVE 0 0.0%
Critical 4 20.0% High 11 55.0% Medium 5 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 10.0% partly blocked 0 0.0% not blocked 18 90.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 20 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 6 / year
Not applicable: 13Outside Waratek scope: 2Mitigation candidate: 3Protected by Waratek: 2 Medium: 5High: 11Critical: 4 not blocked: 18blocked by ARMR today: 2 Working exploit published: 20
20051 Outside Waratek scope1 Medium1 not blocked1 Working exploit published1 20061 Not applicable1 High1 not blocked1 Working exploit published1 20070 20080 20090 20100 20110 20120 20130 20141 Not applicable1 High1 not blocked1 Working exploit published1 20150 20160 20170 20186 Not applicable6 High2 Medium4 not blocked6 Working exploit published6 20192 Not applicable2 Critical1 High1 not blocked2 Working exploit published2 20202 Protected by Waratek1 Not applicable1 Critical1 High1 blocked by ARMR today1 not blocked1 Working exploit published2 20216 Protected by Waratek1 Mitigation candidate3 Outside Waratek scope1 Not applicable1 Critical2 High4 blocked by ARMR today1 not blocked5 Working exploit published6 20220 20231 Not applicable1 High1 not blocked1 Working exploit published1
2005200720092011201320152017201920212023
20 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-5203 High 2023-12-26 Not applicable Working exploit published The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.
CVE-2021-45043 High 2021-12-15 Not applicable Working exploit published HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.
CVE-2021-39146 High 2021-08-23 Mitigation candidate Working exploit published XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVE-2021-39141 High 2021-08-23 Mitigation candidate Working exploit published XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVE-2021-29505 High 2021-05-28 Mitigation candidate Working exploit published XStream is software for serializing Java objects to XML and back again. A vulnerability in XStream versions prior to 1.4.17 may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types is affected. The vulnerability is patched in version 1.4.17.
CVE-2021-21351 Critical 2021-03-23 Outside Waratek scope Working exploit published XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CVE-2021-21345 Critical 2021-03-23 Protected by Waratek Working exploit published XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. If you rely on XStream's default blacklist of the Security Framework, you will have to use at least version 1.4.16.
CVE-2020-26217 High 2020-11-16 Protected by Waratek Working exploit published XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
CVE-2020-13118 Critical 2020-05-16 Not applicable Working exploit published An issue was discovered in Mikrotik-Router-Monitoring-System through 2018-10-22. SQL Injection exists in check_community.php via the parameter community.
CVE-2018-19113 High 2019-04-01 Not applicable Working exploit published The Pronestor PNHM (aka Health Monitoring or HealthMonitor) add-in before 8.1.13.0 for Outlook has "BUILTIN\Users:(I)(F)" permissions for the "%PROGRAMFILES(X86)%\proNestor\Outlook add-in for Pronestor\PronestorHealthMonitor.exe" file, which allows local users to gain privileges via a Trojan horse PronestorHealthMonitor.exe file.
CVE-2018-18798 Critical 2019-03-21 Not applicable Working exploit published Attendance Monitoring System 1.0 has SQL Injection via the 'id' parameter to student/index.php?view=view, event/index.php?view=view, and user/index.php?view=view.
CVE-2018-18799 High 2018-11-16 Not applicable Working exploit published School Attendance Monitoring System 1.0 has CSRF via event/controller.php?action=photos.
CVE-2018-18797 High 2018-11-16 Not applicable Working exploit published School Attendance Monitoring System 1.0 has CSRF via /user/user/edit.php.
CVE-2018-12525 Medium 2018-06-18 Not applicable Working exploit published An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /images/ provides a directory listing.
CVE-2018-12524 Medium 2018-06-18 Not applicable Working exploit published An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /lib/ provides a directory listing.
CVE-2018-12523 Medium 2018-06-18 Not applicable Working exploit published An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /etc/ provides a directory listing.
CVE-2018-12522 Medium 2018-06-18 Not applicable Working exploit published An issue was discovered in perfSONAR Monitoring and Debugging Dashboard (MaDDash) 2.0.2. A direct request to /style/ provides a directory listing.
CVE-2013-5467 High 2014-08-29 Not applicable Working exploit published Monitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04 and Monitoring Server (ms) and Shared Libraries (ax) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP08, 6.2.3 through FP01, and 6.3.0 through FP01 in IBM Tivoli Monitoring (ITM) on UNIX allow local users to gain privileges via unspecified vectors.
CVE-2006-3733 High 2006-07-21 Not applicable Working exploit published jmx-console/HtmlAdaptor in the jmx-console in the JBoss web application server, as shipped with Cisco Security Monitoring, Analysis and Response System (CS-MARS) before 4.2.1, allows remote attackers to gain privileges as the CS-MARS administrator and execute arbitrary Java code via an invokeOp action in the BSHDeployer jboss.scripts service name.
CVE-2005-0356 Medium 2005-05-31 Outside Waratek scope Working exploit published Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to cause a denial of service (connection loss) via a spoofed packet with a large timer value, which causes the host to discard later packets because they appear to be too old.