WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product quality✕
Overview 5 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5
5matches 1in Waratek scope20.0% 1protected20.0% 0exploited0.0% 0CISA KEV0.0% 2EPSS ≥ 0.540.0%
Protected by Waratek 1 20.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 4 80.0% Withdrawn CVE 0 0.0%
Critical 1 20.0% High 2 40.0% Medium 2 40.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 20.0% partly blocked 0 0.0% not blocked 4 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 5 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 4Protected by Waratek: 1 Medium: 2High: 2Critical: 1 not blocked: 4blocked by ARMR today: 1 Working exploit published: 5
20072 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20080 20090 20101 Not applicable1 Medium1 not blocked1 Working exploit published1 20110 20120 20130 20140 20151 Not applicable1 High1 not blocked1 Working exploit published1 20160 20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1
20072008200920102011201220132014201520162017
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2014-9566 High 2015-03-10 Not applicable Working exploit published Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager (NCM) before 7.3.2, IP Address Manager (IPAM) before 4.3, User Device Tracker (UDT) before 3.2, VoIP & Network Quality Manager (VNQM) before 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, and possibly other Solarwinds products, allow remote authenticated users to execute arbitrary SQL commands via the (1) dir or (2) sort parameter to the (a) GetAccounts or (b) GetAccountGroups endpoint.
CVE-2010-4094 Medium 2010-10-26 Not applicable Working exploit published The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier for remote attackers to execute arbitrary code by leveraging access to the manager role. NOTE: this might overlap CVE-2009-3548.
CVE-2007-1882 Medium 2007-04-06 Not applicable Working exploit published qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment in HP Mercury Quality Center 9.0 build 9.1.0.4352 allows remote authenticated users to execute arbitrary SQL commands via the RunQuery method.
CVE-2007-1819 High 2007-04-02 Not applicable Working exploit published Stack-based buffer overflow in the SPIDERLib.Loader ActiveX control (Spider90.ocx) 9.1.0.4353 in TestDirector (TD) for Mercury Quality Center 9.0 before Patch 12.1, and 8.2 SP1 before Patch 32, allows remote attackers to execute arbitrary code via a long ProgColor property.