WaratekVRT Sign in

Eclipse CVEs with a working exploit

4 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
Vendor eclipse✕
Overview 4 matches · 2 protected · 0 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
4matches 2protected50.0% 0exploited0.0% 0CISA KEV0.0% 3EPSS ≥ 0.575.0%
Protected by Waratek 2 50.0% Rule in development 0 0.0% Mitigation candidate 2 50.0% No exploit published 0 0.0%
Critical 1 25.0% High 1 25.0% Medium 2 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 50.0% partly blocked 0 0.0% not blocked 2 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 4 100.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Mitigation candidate: 2Protected by Waratek: 2 Medium: 2High: 1Critical: 1 not blocked: 2blocked by ARMR today: 2 Working exploit published: 4
Q4 161 Mitigation candidate1 High1 not blocked1 Working exploit published1 Q1 170 Q2 170 Q3 170 Q4 170 Q1 180 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 201 Mitigation candidate1 Critical1 not blocked1 Working exploit published1 Q2 200 Q3 200 Q4 200 Q1 210 Q2 212 Protected by Waratek2 Medium2 blocked by ARMR today2 Working exploit published2
Q4 16Q2 17Q4 17Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-6950 Medium 2021-06-02 Protected by Waratek Working exploit published Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter.
CVE-2021-28164 Medium 2021-04-01 Protected by Waratek Working exploit published In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVE-2014-9390 Critical 2020-02-12 Mitigation candidate Working exploit published Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
CVE-2015-2080 High 2016-10-07 Mitigation candidate Working exploit published The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.