Overview 125 matches · 17 in Waratek scope · 4 protected · 2 exploited · 0 CISA KEV · 6 public PoC · 1 EPSS ≥ 0.5
125matches
17in Waratek scope13.6%
4protected3.2%
2exploited1.6%
0CISA KEV0.0%
6public PoC4.8%
1EPSS ≥ 0.50.8%
Protected by Waratek
4
3.2%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
13
10.4%
Outside Waratek scope
0
0.0%
Not applicable
108
86.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
4
3.2%
partly blocked
0
0.0%
not blocked
121
96.8%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 26 / year
19991
Not applicable1
Medium1
not blocked1
No public exploit1
20000
20010
20020
20030
20040
20050
20064
Not applicable4
High1
Medium2
Low1
not blocked4
Working exploit published1
No public exploit3
20071
Not applicable1
High1
not blocked1
Working exploit published1
20081
Not applicable1
High1
not blocked1
Working exploit published1
20092
Not applicable2
Medium2
not blocked2
No public exploit2
20100
20114
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20121
Not applicable1
Medium1
not blocked1
No public exploit1
20131
Not applicable1
Low1
not blocked1
No public exploit1
20140
20150
20160
20172
Protected by Waratek2
High2
blocked by ARMR today2
No public exploit2
201822
No exploit published2
Not applicable20
Critical8
High11
Medium3
not blocked22
No public exploit22
201913
No exploit published2
Not applicable11
Critical2
High5
Medium6
not blocked13
No public exploit13
202012
Not applicable12
Critical4
High7
Medium1
not blocked12
Exploited1
No public exploit11
20216
Not applicable6
Critical1
High3
Medium2
not blocked6
No public exploit6
202211
No exploit published2
Not applicable9
Critical2
High6
Medium3
not blocked11
Proof of concept only3
No public exploit8
202310
No exploit published3
Not applicable7
Critical2
High3
Medium5
not blocked10
Proof of concept only4
No public exploit6
20245
Not applicable5
High3
Medium2
not blocked5
Proof of concept only1
No public exploit4
20253
Protected by Waratek2
Not applicable1
Critical2
High1
blocked by ARMR today2
not blocked1
Exploited1
Working exploit published1
No public exploit1
202626
No exploit published4
Not applicable22
Critical1
High11
Medium12
Low2
not blocked26
Proof of concept only12
No public exploit14
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2016-10660 | High | 2018-06-04 | Not applicable | No public exploit | fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2016-10632 | High | 2018-06-01 | Not applicable | No public exploit | apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2016-10574 | High | 2018-06-01 | Not applicable | No public exploit | apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2016-10564 | High | 2018-05-31 | Not applicable | No public exploit | apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2016-10666 | High | 2018-05-29 | Not applicable | No public exploit | tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server. |
| CVE-2018-11128 | High | 2018-05-17 | Not applicable | No public exploit | The ObjReader::ReadObj() function in ObjReader.cpp in vincent0629 PDFParser allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly execute arbitrary code via a crafted pdf file. |
| CVE-2018-1339 | Medium | 2018-04-25 | No exploit published | No public exploit | A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18. |
| CVE-2018-7560 | High | 2018-03-04 | Not applicable | No public exploit | index.js in the Anton Myshenin aws-lambda-multipart-parser NPM package before 0.1.2 has a Regular Expression Denial of Service (ReDoS) issue via a crafted multipart/form-data boundary string. |
| CVE-2017-1000207 | High | 2017-11-27 | Protected by Waratek | No public exploit | A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification. |
| CVE-2017-1000208 | High | 2017-11-17 | Protected by Waratek | No public exploit | A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification. |
| CVE-2013-0162 | Low | 2013-03-01 | Not applicable | No public exploit | The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp. |
| CVE-2012-2921 | Medium | 2012-05-21 | Not applicable | No public exploit | Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document. |
| CVE-2011-1158 | Medium | 2011-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI. |
| CVE-2011-1157 | Medium | 2011-04-11 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments. |
| CVE-2011-1156 | Medium | 2011-04-11 | Not applicable | No public exploit | feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration. |
| CVE-2009-5065 | Medium | 2011-04-11 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas. |
| CVE-2009-3627 | Medium | 2009-10-29 | Not applicable | No public exploit | The decode_entities function in util.c in HTML-Parser before 3.63 allows context-dependent attackers to cause a denial of service (infinite loop) via an incomplete SGML numeric character reference, which triggers generation of an invalid UTF-8 character. |
| CVE-2009-3198 | Medium | 2009-09-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech Affiliate Master Datafeed Parser Script 2.0 allows remote attackers to inject arbitrary web script or HTML via the search parameter. |
| CVE-2008-3285 | High | 2008-07-24 | Not applicable | Working exploit published | The Filesys::SmbClientParser module 2.7 and earlier for Perl allows remote SMB servers to execute arbitrary code via a folder name containing shell metacharacters. |
| CVE-2007-2857 | High | 2007-05-24 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in sample/xls2mysql in ABC Excel Parser Pro 4.0 allows remote attackers to execute arbitrary PHP code via a URL in the parser_path parameter. |
| CVE-2006-4686 | High | 2006-10-10 | Not applicable | No public exploit | Buffer overflow in the Extensible Stylesheet Language Transformations (XSLT) processing in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 allows remote attackers to execute arbitrary code via a crafted Web page. |
| CVE-2006-4685 | Low | 2006-10-10 | Not applicable | No public exploit | The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains. |
| CVE-2006-1584 | Medium | 2006-04-02 | Not applicable | Working exploit published | Unspecified vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter, possibly related to fopen function calls or file uploads. NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this product, and "id" might be the affected parameter. |
| CVE-2006-1583 | Medium | 2006-04-02 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in Warcraft III Replay Parser for PHP 1.8c allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: post-disclosure analysis by CVE suggests that the "page" parameter is not used in this product, and "id" might be the affected parameter. |
| CVE-1999-1378 | Medium | 1999-07-19 | Not applicable | No public exploit | dbmlparser.exe CGI guestbook program does not perform a chroot operation properly, which allows remote attackers to read arbitrary files. |