Overview 108 matches · 24 in Waratek scope · 6 protected · 3 exploited · 2 CISA KEV · 4 public PoC · 3 EPSS ≥ 0.5
108matches
24in Waratek scope22.2%
6protected5.6%
3exploited2.8%
2CISA KEV1.9%
4public PoC3.7%
3EPSS ≥ 0.52.8%
Protected by Waratek
6
5.6%
Rule in development
0
0.0%
Mitigation candidate
2
1.9%
No exploit published
16
14.8%
Outside Waratek scope
3
2.8%
Not applicable
81
75.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
6
5.6%
partly blocked
0
0.0%
not blocked
102
94.4%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
3
2.8%
Working exploit published
0
0.0%
Proof of concept only
3
2.8%
Forecast only
0
0.0%
No public exploit
102
94.4%
split by
peak 31 / year
20051
Not applicable1
High1
not blocked1
No public exploit1
20060
20070
20080
20090
20100
20110
20120
20130
20140
20150
20160
20171
Not applicable1
Medium1
not blocked1
No public exploit1
201811
Not applicable11
High6
Medium5
not blocked11
No public exploit11
201910
Not applicable10
Critical1
High2
Medium6
Low1
not blocked10
No public exploit10
20207
Protected by Waratek1
No exploit published4
Outside Waratek scope1
Not applicable1
Critical1
High3
Medium3
blocked by ARMR today1
not blocked6
No public exploit7
20218
Protected by Waratek3
No exploit published2
Outside Waratek scope2
Not applicable1
Critical1
High4
Medium3
blocked by ARMR today3
not blocked5
Exploited2
No public exploit6
202231
Protected by Waratek1
Mitigation candidate1
No exploit published2
Not applicable27
Critical3
High9
Medium18
Low1
blocked by ARMR today1
not blocked30
Proof of concept only2
No public exploit29
202325
Protected by Waratek1
Mitigation candidate1
No exploit published2
Not applicable21
Critical2
High7
Medium15
Low1
blocked by ARMR today1
not blocked24
Exploited1
No public exploit24
20243
No exploit published1
Not applicable2
High1
Medium2
not blocked3
No public exploit3
20256
No exploit published1
Not applicable5
High1
Medium5
not blocked6
No public exploit6
20265
No exploit published4
Not applicable1
Critical4
Medium1
not blocked5
Proof of concept only1
No public exploit4
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2018-1795 | Medium | 2018-10-05 | Not applicable | No public exploit | IBM Robotic Process Automation with Automation Anywhere Enterprise 10 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 149073. |
| CVE-2018-1547 | High | 2018-06-07 | Not applicable | No public exploit | IBM Robotic Process Automation with Automation Anywhere 10.0 could allow a remote attacker to execute arbitrary code on the system, caused by improper output encoding in an CSV export. By persuading a victim to download the CSV export, to open it in Microsoft Excel and to confirm the two security questions, an attacker could exploit this vulnerability to run any command or program on the victim's machine. IBM X-Force ID: 142651. |
| CVE-2018-1514 | High | 2018-06-07 | Not applicable | No public exploit | IBM Robotic Process Automation with Automation Anywhere 10.0 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 141622. |
| CVE-2018-2401 | High | 2018-03-14 | Not applicable | No public exploit | SAP Business Process Automation (BPA) By Redwood does not sufficiently validate an XML document accepted from an untrusted source resulting in an XML External Entity (XXE) vulnerability. |
| CVE-2018-2400 | High | 2018-03-14 | Not applicable | No public exploit | Under certain conditions SAP Business Process Automation (BPA) By Redwood, 9.00, 9.10, allows an attacker to access information which would otherwise be restricted. |
| CVE-2018-2366 | Medium | 2018-03-14 | Not applicable | No public exploit | SAP Business Process Automation (BPA) By Redwood, 9.0, 9.1, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs. |
| CVE-2017-1751 | Medium | 2017-12-20 | Not applicable | No public exploit | IBM Robotic Process Automation with Automation Anywhere 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 135546. |
| CVE-2005-3653 | High | 2005-12-31 | Not applicable | No public exploit | Heap-based buffer overflow in the iGateway service for various Computer Associates (CA) iTechnology products, in iTechnology iGateway before 4.0.051230, allows remote attackers to execute arbitrary code via an HTTP request with a negative Content-Length field. |