Overview 157 matches · 6 in Waratek scope · 1 protected · 4 exploited · 3 CISA KEV · 9 public PoC · 6 EPSS ≥ 0.5
157matches
6in Waratek scope3.8%
1protected0.6%
4exploited2.5%
3CISA KEV1.9%
9public PoC5.7%
6EPSS ≥ 0.53.8%
Protected by Waratek
1
0.6%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
5
3.2%
Outside Waratek scope
8
5.1%
Not applicable
143
91.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
0.6%
partly blocked
0
0.0%
not blocked
156
99.4%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
4
2.5%
Working exploit published
5
3.2%
Proof of concept only
0
0.0%
Forecast only
2
1.3%
No public exploit
146
93.0%
split by
peak 36 / quarter
Q2 121
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 121
Not applicable1
Medium1
not blocked1
No public exploit1
Q4 120
Q1 131
Not applicable1
High1
not blocked1
No public exploit1
Q2 131
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 130
Q4 130
Q1 146
Outside Waratek scope6
Medium6
not blocked6
No public exploit6
Q2 140
Q3 145
Not applicable5
High3
Medium2
not blocked5
No public exploit5
Q4 149
Not applicable9
High1
Medium6
Low2
not blocked9
No public exploit9
Q1 1520
Not applicable20
High8
Medium11
Low1
not blocked20
No public exploit20
Q2 1515
Not applicable15
High6
Medium9
not blocked15
Working exploit published1
No public exploit14
Q3 152
Not applicable2
High1
Medium1
not blocked2
No public exploit2
Q4 1517
No exploit published2
Not applicable15
High6
Medium10
Low1
not blocked17
Exploited1
Working exploit published1
No public exploit15
Q1 1612
Outside Waratek scope1
Not applicable11
High3
Medium4
Low5
not blocked12
Exploited1
No public exploit11
Q2 1636
Protected by Waratek1
No exploit published2
Outside Waratek scope1
Not applicable32
Critical8
High17
Medium10
Low1
blocked by ARMR today1
not blocked35
Exploited2
Working exploit published3
Forecast only1
No public exploit30
Q3 167
No exploit published1
Not applicable6
High5
Medium2
not blocked7
Forecast only1
No public exploit6
Q4 163
Not applicable3
Critical1
Medium2
not blocked3
No public exploit3
Q1 174
Not applicable4
Critical3
High1
not blocked4
No public exploit4
Q2 1712
Not applicable12
Critical2
High8
Medium1
Low1
not blocked12
No public exploit12
Q3 175
Not applicable5
High4
Medium1
not blocked5
No public exploit5
Q3 12Q1 13Q3 13Q1 14Q3 14Q1 15Q3 15Q1 16Q3 16Q1 17Q3 17
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2015-4147 | High | 2015-06-09 | Not applicable | No public exploit | The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected data type, related to a "type confusion" issue. |
| CVE-2015-4026 | High | 2015-06-09 | Not applicable | No public exploit | The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a crafted first argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. |
| CVE-2015-4025 | High | 2015-06-09 | Not applicable | No public exploit | PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a crafted argument to (1) set_include_path, (2) tempnam, (3) rmdir, or (4) readlink. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. |
| CVE-2015-4024 | Medium | 2015-06-09 | Not applicable | No public exploit | Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an improper order-of-growth outcome. |
| CVE-2015-4022 | High | 2015-06-09 | Not applicable | No public exploit | Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow. |
| CVE-2015-4021 | Medium | 2015-06-09 | Not applicable | No public exploit | The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer underflow and memory corruption) via a crafted entry in a tar archive. |
| CVE-2015-3330 | Medium | 2015-06-09 | Not applicable | No public exploit | The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via pipelined HTTP requests that result in a "deconfigured interpreter." |
| CVE-2015-3329 | High | 2015-06-09 | Not applicable | No public exploit | Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive. |
| CVE-2015-3307 | High | 2015-06-09 | Not applicable | No public exploit | The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive. |
| CVE-2015-2783 | Medium | 2015-06-09 | Not applicable | No public exploit | ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with crafted serialized data in a phar archive, related to the phar_parse_metadata and phar_parse_pharfile functions. |
| CVE-2015-1863 | Medium | 2015-04-28 | Not applicable | No public exploit | Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries. |
| CVE-2015-0251 | Medium | 2015-04-08 | Not applicable | No public exploit | The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences. |
| CVE-2015-0248 | Medium | 2015-04-08 | Not applicable | No public exploit | The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers. |
| CVE-2015-2787 | High | 2015-03-30 | Not applicable | No public exploit | Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages use of the unset function within an __wakeup function, a related issue to CVE-2015-0231. |
| CVE-2015-2348 | Medium | 2015-03-30 | Not applicable | No public exploit | The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a \x00 character, which allows remote attackers to bypass intended extension restrictions and create files with unexpected names via a crafted second argument. NOTE: this vulnerability exists because of an incomplete fix for CVE-2006-7243. |
| CVE-2015-2301 | High | 2015-03-30 | Not applicable | No public exploit | Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file. |
| CVE-2014-8169 | Medium | 2015-03-18 | Not applicable | No public exploit | automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used to run the mapped program, which allows local users to gain privileges via a Trojan horse program in the user home directory. |
| CVE-2014-9675 | Medium | 2015-02-08 | Not applicable | No public exploit | bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer values and bypass the ASLR protection mechanism via a crafted BDF font. |
| CVE-2014-9674 | High | 2015-02-08 | Not applicable | No public exploit | The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote attackers to cause a denial of service (integer overflow and heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font. |
| CVE-2014-9673 | Medium | 2015-02-08 | Not applicable | No public exploit | Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a crafted Mac font. |
| CVE-2014-9671 | Medium | 2015-02-08 | Not applicable | No public exploit | Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted PCF file with a 0xffffffff size value that is improperly incremented. |
| CVE-2014-9670 | Medium | 2015-02-08 | Not applicable | No public exploit | Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer overflow, NULL pointer dereference, and application crash) via a crafted PCF file that specifies negative values for the first column and first row. |
| CVE-2014-9669 | Medium | 2015-02-08 | Not applicable | No public exploit | Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have unspecified other impact via a crafted cmap SFNT table. |
| CVE-2014-9667 | Medium | 2015-02-08 | Not applicable | No public exploit | sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted SFNT table. |
| CVE-2014-9666 | Medium | 2015-02-08 | Not applicable | No public exploit | The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote attackers to cause a denial of service (integer overflow and out-of-bounds read) or possibly have unspecified other impact via a crafted embedded bitmap. |
| CVE-2014-9664 | Medium | 2015-02-08 | Not applicable | No public exploit | FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted Type42 font, related to type42/t42parse.c and type1/t1load.c. |
| CVE-2014-9663 | High | 2015-02-08 | Not applicable | No public exploit | The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted cmap SFNT table. |
| CVE-2014-9661 | High | 2015-02-08 | Not applicable | No public exploit | type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted Type42 font. |
| CVE-2014-9660 | High | 2015-02-08 | Not applicable | No public exploit | The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a crafted BDF font. |
| CVE-2014-9658 | High | 2015-02-08 | Not applicable | No public exploit | The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font. |
| CVE-2014-9657 | High | 2015-02-08 | Not applicable | No public exploit | The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted TrueType font. |
| CVE-2015-0236 | Low | 2015-01-29 | Not applicable | No public exploit | libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface. |
| CVE-2015-0432 | Medium | 2015-01-21 | Not applicable | No public exploit | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign Key. |
| CVE-2014-7300 | High | 2014-12-25 | Not applicable | No public exploit | GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer. |
| CVE-2014-8136 | Low | 2014-12-19 | Not applicable | No public exploit | The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local users to cause a denial of service via unspecified vectors. |
| CVE-2014-8108 | Medium | 2014-12-18 | Not applicable | No public exploit | The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist. |
| CVE-2014-3580 | Medium | 2014-12-18 | Not applicable | No public exploit | The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist. |
| CVE-2014-9273 | Medium | 2014-12-08 | Not applicable | No public exploit | lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write. |
| CVE-2012-6662 | Medium | 2014-11-24 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title attribute, which is not properly handled in the autocomplete combo box demo. |
| CVE-2014-4975 | Medium | 2014-11-15 | Not applicable | No public exploit | Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow. |
| CVE-2014-8564 | Medium | 2014-11-13 | Not applicable | No public exploit | The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted (1) Elliptic Curve Cryptography (ECC) certificate or (2) certificate signing requests (CSR), related to generating key IDs. |
| CVE-2014-3640 | Low | 2014-11-07 | Not applicable | No public exploit | The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in the source port and address, which triggers access of an uninitialized socket. |
| CVE-2014-7145 | High | 2014-09-28 | Not applicable | No public exploit | The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals. |
| CVE-2014-3528 | Medium | 2014-08-19 | Not applicable | No public exploit | Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm. |
| CVE-2014-4344 | High | 2014-08-14 | Not applicable | No public exploit | The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation. |
| CVE-2014-4343 | High | 2014-08-14 | Not applicable | No public exploit | Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator. |
| CVE-2014-4342 | Medium | 2014-07-20 | Not applicable | No public exploit | MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application crash) by injecting invalid tokens into a GSSAPI application session. |
| CVE-2014-0418 | Medium | 2014-01-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 6u65 and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment, a different vulnerability than CVE-2013-5889, CVE-2013-5902, CVE-2014-0410, CVE-2014-0415, and CVE-2014-0424. |
| CVE-2014-0382 | Medium | 2014-01-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect availability via unknown vectors related to JavaFX. |
| CVE-2013-5906 | Medium | 2014-01-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 5.0u55, 6u65, and 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Install, a different vulnerability than CVE-2013-5905. |
| CVE-2013-5904 | Medium | 2014-01-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 7u45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Deployment. |
| CVE-2013-5895 | Medium | 2014-01-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect confidentiality via unknown vectors related to JavaFX. |
| CVE-2013-5870 | Medium | 2014-01-15 | Outside Waratek scope | No public exploit | Unspecified vulnerability in Oracle Java SE 7u45 and JavaFX 2.2.45 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to JavaFX. |
| CVE-2012-6137 | Medium | 2013-05-21 | Not applicable | No public exploit | rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red Hat Network, which allows remote man-in-the-middle attackers to obtain sensitive information such as user credentials. |
| CVE-2012-5689 | High | 2013-01-25 | Not applicable | No public exploit | ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service (assertion failure and named daemon exit) via a query for an AAAA record. |
| CVE-2012-0867 | Medium | 2012-07-18 | Not applicable | No public exploit | PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters. |
| CVE-2012-1703 | Medium | 2012-05-03 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via unknown vectors related to Server Optimizer, a different vulnerability than CVE-2012-1690. |