WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product storm✕
Overview 5 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
5matches 1in Waratek scope20.0% 1protected20.0% 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.520.0%
Protected by Waratek 1 20.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 4 80.0% Withdrawn CVE 0 0.0%
Critical 1 20.0% High 4 80.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 20.0% partly blocked 0 0.0% not blocked 4 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 5 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / year
Not applicable: 4Protected by Waratek: 1 High: 4Critical: 1 not blocked: 4blocked by ARMR today: 1 Working exploit published: 5
20061 Not applicable1 High1 not blocked1 Working exploit published1 20071 Not applicable1 High1 not blocked1 Working exploit published1 20081 Not applicable1 High1 not blocked1 Working exploit published1 20091 Not applicable1 High1 not blocked1 Working exploit published1 20100 20110 20120 20130 20140 20150 20160 20170 20180 20190 20200 20211 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1
20072009201120132015201720192021
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-38294 Critical 2021-10-25 Protected by Waratek Working exploit published A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.
CVE-2009-2617 High 2009-07-27 Not applicable Working exploit published Stack-based buffer overflow in medialib.dll in BaoFeng Storm 3.9.62 allows remote attackers to execute arbitrary code via a long pathname in the source attribute of an item element in a .smpl playlist file.
CVE-2008-5726 High 2008-12-26 Not applicable Working exploit published SQL injection vulnerability in thread.php in stormBoards 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter.
CVE-2007-4939 High 2007-09-18 Not applicable Working exploit published Heap-based buffer overflow in mplayerc.exe in Media Player Classic (MPC) 6.4.9.0 and earlier, as used standalone and in mympc (aka CD-Storm) 1.0.0.1, StormPlayer 1.0.4, and possibly other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with an "indx truck size" of 0xffffffff, and certain wLongsPerEntry and nEntriesInuse values.
CVE-2006-5386 High 2006-10-18 Not applicable Working exploit published PHP remote file inclusion vulnerability in process.php in NuralStorm Webmail 0.98b and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the DEFAULT_SKIN parameter.