Working exploit published CVEs

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 1 protected · 0 exploited · 0 CISA KEV · 2 EPSS ≥ 0.5

3matches 1protected33.3% 0exploited0.0% 0CISA KEV0.0% 2EPSS ≥ 0.566.7%

Protected by Waratek 1 33.3% Rule in development 0 0.0% Mitigation candidate 2 66.7% No exploit published 0 0.0%

Critical 1 33.3% High 1 33.3% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 33.3% partly blocked 0 0.0% not blocked 2 66.7% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 3 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 3 / month

Jun 163 Protected by Waratek1 Mitigation candidate2 Critical1 High1 Medium1 blocked by ARMR today1 not blocked2 Working exploit published3

Jun 16

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2016-3670	Medium	2016-06-13	Mitigation candidate	Working exploit published	Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.
CVE-2016-3087	Critical	2016-06-07	Mitigation candidate	Working exploit published	Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
CVE-2015-7611	High	2016-06-07	Protected by Waratek	Working exploit published	Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2016-3670

Medium

2016-06-13

Mitigation candidate

Working exploit published

Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attackers to inject arbitrary web script or HTML via the FirstName field.

CVE-2016-3087

Critical

2016-06-07

Mitigation candidate

Working exploit published

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

CVE-2015-7611

High

2016-06-07

Protected by Waratek

Working exploit published

Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.