WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: Full✕Vendor opensuse✕
Overview 2 matches · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
2matches 0exploited0.0% 0CISA KEV0.0% 1EPSS ≥ 0.550.0%
Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 1 50.0% Medium 1 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / quarter
Protected by Waratek: 2 Medium: 1High: 1 blocked by ARMR today: 2 Working exploit published: 2
Q2 141 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 Q3 140 Q4 140 Q1 150 Q2 150 Q3 150 Q4 150 Q1 160 Q2 160 Q3 160 Q4 160 Q1 170 Q2 170 Q3 170 Q4 170 Q1 180 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 200 Q2 201 Protected by Waratek1 High1 blocked by ARMR today1 Working exploit published1
Q2 14Q4 14Q2 15Q4 15Q2 16Q4 16Q2 17Q4 17Q2 18Q4 18Q2 19Q4 19Q2 20
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-9484 High 2020-05-20 Protected by Waratek Working exploit published When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a file on the server; and b) the server is configured to use the PersistenceManager with a FileStore; and c) the PersistenceManager is configured with sessionAttributeValueClassNameFilter="null" (the default unless a SecurityManager is used) or a sufficiently lax filter to allow the attacker provided object to be deserialized; and d) the attacker knows the relative file path from the storage location used by FileStore to the file the attacker has control over; then, using a specifically crafted request, the attacker will be able to trigger remote code execution via deserialization of the file under their control. Note that all of conditions a) to d) must be true for the attack to succeed.
CVE-2014-3004 Medium 2014-06-11 Protected by Waratek Working exploit published The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document.