Overview 118 matches · 0 in Waratek scope · 0 protected · 3 exploited · 2 CISA KEV · 17 public PoC · 2 EPSS ≥ 0.5
118matches
0in Waratek scope0.0%
0protected0.0%
3exploited2.5%
2CISA KEV1.7%
17public PoC14.4%
2EPSS ≥ 0.51.7%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
2
1.7%
Not applicable
116
98.3%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
118
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 13 / year
20041
Not applicable1
High1
not blocked1
No public exploit1
20051
Not applicable1
Medium1
not blocked1
No public exploit1
20063
Not applicable3
High2
Medium1
not blocked3
Working exploit published3
20071
Not applicable1
Medium1
not blocked1
Working exploit published1
20080
20093
Not applicable3
High3
not blocked3
Working exploit published3
20102
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20111
Not applicable1
Medium1
not blocked1
No public exploit1
20125
Not applicable5
High1
Medium3
Low1
not blocked5
Working exploit published1
No public exploit4
20132
Not applicable2
Medium2
not blocked2
No public exploit2
201411
Not applicable11
Medium7
Low4
not blocked11
Working exploit published1
No public exploit10
20156
Not applicable6
High1
Medium5
not blocked6
No public exploit6
20165
Not applicable5
High1
Medium3
Low1
not blocked5
No public exploit5
201710
Not applicable10
Critical3
High4
Medium3
not blocked10
No public exploit10
20186
Not applicable6
High2
Medium4
not blocked6
No public exploit6
201910
Outside Waratek scope1
Not applicable9
High6
Medium4
not blocked10
Exploited1
Proof of concept only1
No public exploit8
202013
Not applicable13
Critical2
High4
Medium6
Low1
not blocked13
Exploited1
Working exploit published1
Proof of concept only1
No public exploit10
20212
Not applicable2
High2
not blocked2
No public exploit2
20226
Not applicable6
Critical1
High3
Medium1
Low1
not blocked6
Working exploit published1
No public exploit5
20238
Outside Waratek scope1
Not applicable7
Critical4
High1
Medium3
not blocked8
Exploited1
Proof of concept only1
No public exploit6
20248
Not applicable8
Critical1
High2
Medium5
not blocked8
No public exploit8
202511
Not applicable11
Critical4
High6
Low1
not blocked11
Proof of concept only11
20263
Not applicable3
High3
not blocked3
Proof of concept only1
No public exploit2
200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2013-1664 | Medium | 2013-04-03 | Not applicable | No public exploit | The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. |
| CVE-2012-3447 | Medium | 2012-08-20 | Not applicable | No public exploit | virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361. |
| CVE-2012-1585 | Medium | 2012-08-17 | Not applicable | No public exploit | OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk consumption) via a long server name. |
| CVE-2012-2101 | Low | 2012-06-07 | Not applicable | No public exploit | Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated users with certain permissions to cause a denial of service (CPU and hard drive consumption) via a network request that triggers a large number of iptables rules. |
| CVE-2012-1200 | High | 2012-02-18 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in Nova CMS allow remote attackers to execute arbitrary PHP code via a URL in the (1) fileType parameter to optimizer/index.php, (2) id parameter to administrator/modules/moduleslist.php, (3) filename parameter to includes/function/gets.php, or (4) conf[blockfile] parameter to includes/function/usertpl.php. |
| CVE-2012-0030 | Medium | 2012-01-13 | Not applicable | No public exploit | Nova 2011.3 and Essex, when using the OpenStack API, allows remote authenticated users to bypass access restrictions for tenants of other users via an OSAPI request with a modified project_id URI parameter. |
| CVE-2011-4596 | Medium | 2011-12-23 | Not applicable | No public exploit | Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest. |
| CVE-2010-0609 | High | 2010-02-11 | Not applicable | No public exploit | SQL injection vulnerability in header.php in NovaBoard 1.1.2 allows remote attackers to execute arbitrary SQL commands via the nova_name cookie parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2010-0608 | High | 2010-02-11 | Not applicable | Working exploit published | SQL injection vulnerability in index.php in NovaBoard 1.1.2 allows remote attackers to execute arbitrary SQL commands via the forums[] parameter in a search action. |
| CVE-2009-0849 | High | 2009-03-09 | Not applicable | Working exploit published | Stack-based buffer overflow in the DtbClsLogin function in NovaStor NovaNET 12 allows remote attackers to (1) execute arbitrary code on Linux platforms via a long username field during backup domain authentication, related to libnnlindtb.so; or (2) cause a denial of service (daemon crash) on Windows platforms via a long username field during backup domain authentication, related to nnwindtb.dll. NOTE: some of these details are obtained from third party information. |
| CVE-2008-6023 | High | 2009-02-02 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in a newer version of Xnova, possibly 0.8 sp1, allows remote attackers to execute arbitrary PHP code via a URL in the xnova_root_path parameter. |
| CVE-2008-6022 | High | 2009-02-02 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in includes/todofleetcontrol.php in an older version of Xnova, possibly 0.8 sp1, allows remote attackers to execute arbitrary PHP code via a URL in the ugamela_root_path parameter. |
| CVE-2007-5480 | Medium | 2007-10-16 | Not applicable | Working exploit published | Multiple cross-site scripting (XSS) vulnerabilities in InnovaAge InnovaShop allow remote attackers to inject arbitrary web script or HTML via the (1) msg parameter to msg.jsp, and the (2) contentid parameter to tc/contents/home001.jsp. |
| CVE-2006-4915 | Medium | 2006-09-21 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in index.php in Innovate Portal 2.0 allows remote attackers to inject arbitrary web script or HTML via the content parameter. |
| CVE-2006-4277 | High | 2006-08-21 | Not applicable | Working exploit published | Multiple PHP remote file inclusion vulnerabilities in Tutti Nova 1.6 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the TNLIB_DIR parameter to (1) include/novalib/class.novaAdmin.mysql.php and (2) novalib/class.novaRead.mysql.php. NOTE: the provenance of this information is unknown; the details are obtained from third party information. |
| CVE-2006-4276 | High | 2006-08-21 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in Tutti Nova 1.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the TNLIB_DIR parameter to novalib/class.novaEdit.mysql.php. |
| CVE-2005-4219 | Medium | 2005-12-14 | Not applicable | No public exploit | setting.php in Innovative CMS (ICMS, formerly Imoel-CMS) contains username and password information in cleartext, which might allow attackers to obtain this information via a direct request to setting.php. NOTE: on a properly configured web server, it would be expected that a .php file would be processed before content is returned to the user, so this might not be a vulnerability. |
| CVE-2004-2453 | High | 2004-12-31 | Not applicable | No public exploit | Unknown vulnerability in Tutti Nova 0.10 through 0.12 (Beta) and 0.9.4, when register_globals is enabled, has unknown impact and attack vectors. |