WaratekVRT Sign in

High Security CVEs

103 CVEs, 4 exploited, 9 protected by Waratek

Reset
More filters (1)
Columns
Product security✕
Overview 103 matches · 9 protected · 4 exploited · 1 CISA KEV · 5 public PoC · 4 EPSS ≥ 0.5
103matches 9protected8.7% 4exploited3.9% 1CISA KEV1.0% 5public PoC4.9% 4EPSS ≥ 0.53.9%
Protected by Waratek 9 8.7% Rule in development 0 0.0% Mitigation candidate 5 4.9% No exploit published 89 86.4%
Critical 0 0.0% High 103 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 9 8.7% partly blocked 0 0.0% not blocked 94 91.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 3.9% Working exploit published 1 1.0% Proof of concept only 3 2.9% Forecast only 0 0.0% No public exploit 95 92.2%
split by peak 35 / year
No exploit published: 89Mitigation candidate: 5Protected by Waratek: 9 High: 103 not blocked: 94blocked by ARMR today: 9 No public exploit: 95Proof of concept only: 3Working exploit published: 1Exploited: 4
20162 No exploit published2 High2 not blocked2 No public exploit2 20178 Protected by Waratek1 Mitigation candidate1 No exploit published6 High8 blocked by ARMR today1 not blocked7 Exploited1 No public exploit7 20186 No exploit published6 High6 not blocked6 No public exploit6 201911 Mitigation candidate3 No exploit published8 High11 not blocked11 Exploited2 Working exploit published1 No public exploit8 20205 No exploit published5 High5 not blocked5 No public exploit5 20217 Protected by Waratek4 No exploit published3 High7 blocked by ARMR today4 not blocked3 No public exploit7 20229 No exploit published9 High9 not blocked9 Proof of concept only1 No public exploit8 20235 Protected by Waratek2 Mitigation candidate1 No exploit published2 High5 blocked by ARMR today2 not blocked3 Exploited1 No public exploit4 20248 No exploit published8 High8 not blocked8 No public exploit8 20257 No exploit published7 High7 not blocked7 Proof of concept only1 No public exploit6 202635 Protected by Waratek2 No exploit published33 High35 blocked by ARMR today2 not blocked33 Proof of concept only1 No public exploit34
20162017201820192020202120222023202420252026
103 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2016-9879 High 2017-01-06 No exploit published No public exploit An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.
CVE-2016-8281 High 2016-10-25 No exploit published No public exploit Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-5536.
CVE-2016-5536 High 2016-10-25 No exploit published No public exploit Unspecified vulnerability in the Oracle Platform Security for Java component in Oracle Fusion Middleware 12.1.3.0.0, 12.2.1.0.0, and 12.2.1.1.0 allows remote authenticated users to affect confidentiality, integrity, and availability via unknown vectors, a different vulnerability than CVE-2016-8281.
‹ prev page 2 of 2 next ›