WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product jasper✕
Overview 132 matches · 7 in Waratek scope · 3 protected · 2 exploited · 2 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
132matches 7in Waratek scope5.3% 3protected2.3% 2exploited1.5% 2CISA KEV1.5% 2public PoC1.5% 1EPSS ≥ 0.50.8%
Protected by Waratek 3 2.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 3.0% Outside Waratek scope 0 0.0% Not applicable 125 94.7% Withdrawn CVE 0 0.0%
Critical 7 5.3% High 57 43.2% Medium 65 49.2% Low 3 2.3% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 2.3% partly blocked 0 0.0% not blocked 129 97.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 1.5% Working exploit published 0 0.0% Proof of concept only 5 3.8% Forecast only 0 0.0% No public exploit 125 94.7%
split by peak 61 / year
Not applicable: 125No exploit published: 4Protected by Waratek: 3 Low: 3Medium: 65High: 57Critical: 7 not blocked: 129blocked by ARMR today: 3 No public exploit: 125Proof of concept only: 5Exploited: 2
20071 Not applicable1 Medium1 not blocked1 No public exploit1 20083 Not applicable3 High3 not blocked3 No public exploit3 20090 20100 20113 Not applicable3 Medium3 not blocked3 No public exploit3 20120 20130 20144 Protected by Waratek1 Not applicable3 High2 Medium2 blocked by ARMR today1 not blocked3 No public exploit4 20152 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20164 Not applicable4 High1 Medium3 not blocked4 No public exploit4 201761 No exploit published1 Not applicable60 Critical2 High26 Medium33 not blocked61 No public exploit61 201820 Not applicable20 High8 Medium12 not blocked20 Exploited1 No public exploit19 20196 Not applicable6 Critical1 High3 Medium2 not blocked6 Exploited1 No public exploit5 20204 No exploit published2 Not applicable2 Critical1 High3 not blocked4 No public exploit4 20219 Not applicable9 Critical1 High2 Medium6 not blocked9 No public exploit9 20227 Not applicable7 Critical2 High4 Medium1 not blocked7 Proof of concept only1 No public exploit6 20230 20243 No exploit published1 Not applicable2 High2 Medium1 not blocked3 Proof of concept only1 No public exploit2 20254 Protected by Waratek1 Not applicable3 High1 Low3 blocked by ARMR today1 not blocked3 Proof of concept only3 No public exploit1 20261 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
2008201020122014201620182020202220242026
132 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2016-10248 High 2017-03-15 Not applicable No public exploit The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer dereference) via vectors involving an empty sequence.
CVE-2017-5504 Medium 2017-03-01 Not applicable No public exploit The jpc_undo_roi function in libjasper/jpc/jpc_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory read and crash) via a crafted image.
CVE-2017-5503 Medium 2017-03-01 Not applicable No public exploit The dec_clnpass function in libjasper/jpc/jpc_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory write and crash) or possibly have unspecified other impact via a crafted image.
CVE-2017-5502 Medium 2017-03-01 Not applicable No public exploit libjasper/jp2/jp2_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVE-2017-5501 Medium 2017-03-01 Not applicable No public exploit Integer overflow in libjasper/jpc/jpc_tsfb.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVE-2017-5500 Medium 2017-03-01 Not applicable No public exploit libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVE-2017-5499 Medium 2017-03-01 Not applicable No public exploit Integer overflow in libjasper/jpc/jpc_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted file.
CVE-2017-5498 Medium 2017-03-01 Not applicable No public exploit libjasper/include/jasper/jas_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative value.
CVE-2016-9560 High 2017-02-15 Not applicable No public exploit Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
CVE-2016-8693 High 2017-02-15 Not applicable No public exploit Double free vulnerability in the mem_close function in jas_stream.c in JasPer before 1.900.10 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image to the imginfo command.
CVE-2016-8692 Medium 2017-02-15 Not applicable No public exploit The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted YRsiz value in a BMP image to the imginfo command.
CVE-2016-8691 Medium 2017-02-15 Not applicable No public exploit The jpc_dec_process_siz function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.4 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted XRsiz value in a BMP image to the imginfo command.
CVE-2016-8690 Medium 2017-02-15 Not applicable No public exploit The bmp_getdata function in libjasper/bmp/bmp_dec.c in JasPer before 1.900.5 allows remote attackers to cause a denial of service (NULL pointer dereference) via a crafted BMP image in an imginfo command.
CVE-2016-8883 Medium 2017-01-13 Not applicable No public exploit The jpc_dec_tiledecode function in jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failure) via a crafted file.
CVE-2016-8882 Medium 2017-01-13 Not applicable No public exploit The jpc_dec_tilefini function in libjasper/jpc/jpc_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted file.
CVE-2016-2116 Medium 2016-04-13 Not applicable No public exploit Memory leak in the jas_iccprof_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (memory consumption) via a crafted ICC color profile in a JPEG 2000 image file.
CVE-2016-1577 High 2016-04-13 Not applicable No public exploit Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file, a different vulnerability than CVE-2014-8137.
CVE-2016-2089 Medium 2016-02-08 Not applicable No public exploit The jas_matrix_clip function in jas_seq.c in JasPer 1.900.1 allows remote attackers to cause a denial of service (invalid read and application crash) via a crafted JPEG 2000 image.
CVE-2016-1867 Medium 2016-01-20 Not applicable No public exploit The jpc_pi_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG 2000 image.
CVE-2014-8158 Medium 2015-01-26 Not applicable No public exploit Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 and earlier allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image.
CVE-2014-8157 High 2015-01-26 Not applicable No public exploit Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 image, which triggers a heap-based buffer overflow.
CVE-2014-8138 High 2014-12-24 Not applicable No public exploit Heap-based buffer overflow in the jp2_decode function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted JPEG 2000 file.
CVE-2014-8137 Medium 2014-12-24 Not applicable No public exploit Double free vulnerability in the jas_iccattrval_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted ICC color profile in a JPEG 2000 image file.
CVE-2014-9029 High 2014-12-08 Not applicable No public exploit Multiple off-by-one errors in the (1) jpc_dec_cp_setfromcox and (2) jpc_dec_cp_setfromrgn functions in jpc/jpc_dec.c in JasPer 1.900.1 and earlier allow remote attackers to execute arbitrary code via a crafted jp2 file, which triggers a heap-based buffer overflow.
CVE-2014-0119 Medium 2014-05-31 Protected by Waratek No public exploit Apache Tomcat before 6.0.40, 7.x before 7.0.54, and 8.x before 8.0.6 does not properly constrain the class loader that accesses the XML parser used with an XSLT stylesheet, which allows remote attackers to (1) read arbitrary files via a crafted web application that provides an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, or (2) read files associated with different web applications on a single Tomcat instance via a crafted web application.
CVE-2011-4517 Medium 2011-12-15 Not applicable No public exploit The jpc_crg_getparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 uses an incorrect data type during a certain size calculation, which allows remote attackers to trigger a heap-based buffer overflow and execute arbitrary code, or cause a denial of service (heap memory corruption), via a crafted component registration (CRG) marker segment in a JPEG2000 file.
CVE-2011-4516 Medium 2011-12-15 Not applicable No public exploit Heap-based buffer overflow in the jpc_cox_getcompparms function in libjasper/jpc/jpc_cs.c in JasPer 1.900.1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted numrlvls value in a coding style default (COD) marker segment in a JPEG2000 file.
CVE-2011-1911 Medium 2011-09-20 Not applicable No public exploit JasperServer in JasperReports Server Community Project 3.7.0 and 3.7.1 uses a predictable _flowExecutionKey parameter, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via a brute-force approach.
CVE-2008-3522 High 2008-10-02 Not applicable No public exploit Buffer overflow in the jas_stream_printf function in libjasper/base/jas_stream.c in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via vectors related to the mif_hdr_put function and use of vsprintf.
CVE-2008-3521 High 2008-10-02 Not applicable No public exploit Race condition in the jas_stream_tmpfile function in libjasper/base/jas_stream.c in JasPer 1.900.1 allows local users to cause a denial of service (program exit) by creating the appropriate tmp.XXXXXXXXXX temporary file, which causes Jasper to exit. NOTE: this was originally reported as a symlink issue, but this was incorrect. NOTE: some vendors dispute the severity of this issue, but it satisfies CVE's requirements for inclusion.
CVE-2008-3520 High 2008-10-02 Not applicable No public exploit Multiple integer overflows in JasPer 1.900.1 might allow context-dependent attackers to have an unknown impact via a crafted image file, related to integer multiplication for memory allocation.
CVE-2007-2721 Medium 2007-05-16 Not applicable No public exploit The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer JPEG-2000 library (libjasper) before 1.900 allows remote user-assisted attackers to cause a denial of service (crash) and possibly corrupt the heap via malformed image files, as originally demonstrated using imagemagick convert.
‹ prev page 2 of 2 next ›