WaratekVRT Sign in

Medium Security CVEs

104 CVEs, 2 exploited, 13 protected by Waratek

Reset
More filters (1)
Columns
Product security✕
Overview 104 matches · 13 protected · 2 exploited · 0 CISA KEV · 10 public PoC · 3 EPSS ≥ 0.5
104matches 13protected12.5% 2exploited1.9% 0CISA KEV0.0% 10public PoC9.6% 3EPSS ≥ 0.52.9%
Protected by Waratek 13 12.5% Rule in development 0 0.0% Mitigation candidate 5 4.8% No exploit published 86 82.7%
Critical 0 0.0% High 0 0.0% Medium 104 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 13 12.5% partly blocked 0 0.0% not blocked 91 87.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 1.9% Working exploit published 5 4.8% Proof of concept only 6 5.8% Forecast only 0 0.0% No public exploit 91 87.5%
split by peak 24 / year
No exploit published: 86Mitigation candidate: 5Protected by Waratek: 13 Medium: 104 not blocked: 91blocked by ARMR today: 13 No public exploit: 91Proof of concept only: 6Working exploit published: 5Exploited: 2
20102 Protected by Waratek1 No exploit published1 Medium2 blocked by ARMR today1 not blocked1 Working exploit published1 No public exploit1 20111 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1 20123 Mitigation candidate1 No exploit published2 Medium3 not blocked3 Working exploit published1 No public exploit2 20132 Protected by Waratek1 No exploit published1 Medium2 blocked by ARMR today1 not blocked1 No public exploit2 20143 No exploit published3 Medium3 not blocked3 No public exploit3 20152 No exploit published2 Medium2 not blocked2 No public exploit2 20160 20172 No exploit published2 Medium2 not blocked2 No public exploit2 20184 No exploit published4 Medium4 not blocked4 No public exploit4 201912 Protected by Waratek3 Mitigation candidate2 No exploit published7 Medium12 blocked by ARMR today3 not blocked9 Working exploit published2 No public exploit10 20204 No exploit published4 Medium4 not blocked4 No public exploit4 20216 Protected by Waratek2 Mitigation candidate1 No exploit published3 Medium6 blocked by ARMR today2 not blocked4 Exploited2 Proof of concept only1 No public exploit3 20228 No exploit published8 Medium8 not blocked8 Proof of concept only1 No public exploit7 202314 Protected by Waratek3 Mitigation candidate1 No exploit published10 Medium14 blocked by ARMR today3 not blocked11 Working exploit published1 Proof of concept only2 No public exploit11 20247 Protected by Waratek2 No exploit published5 Medium7 blocked by ARMR today2 not blocked5 No public exploit7 202510 No exploit published10 Medium10 not blocked10 Proof of concept only1 No public exploit9 202624 No exploit published24 Medium24 not blocked24 No public exploit24
201020122014201620182020202220242026
104 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2011-2731 Medium 2012-12-05 No exploit published No public exploit Race condition in the RunAsManager mechanism in VMware SpringSource Spring Security before 2.0.7 and 3.0.x before 3.0.6 stores the Authentication object in the shared security context, which allows attackers to gain privileges via a crafted thread.
CVE-2011-2894 Medium 2011-10-04 Protected by Waratek Proof of concept only Spring Framework 3.0.0 through 3.0.5, Spring Security 3.0.0 through 3.0.5 and 2.0.0 through 2.0.6, and possibly other versions deserialize objects from untrusted sources, which allows remote attackers to bypass intended security restrictions and execute untrusted code by (1) serializing a java.lang.Proxy instance and using InvocationHandler, or (2) accessing internal AOP interfaces, as demonstrated using deserialization of a DefaultListableBeanFactory instance to execute arbitrary commands via the java.lang.Runtime class.
CVE-2010-3863 Medium 2010-11-05 Protected by Waratek Working exploit published Apache Shiro before 1.1.0, and JSecurity 0.9.x, does not canonicalize URI paths before comparing them to entries in the shiro.ini file, which allows remote attackers to bypass intended access restrictions via a crafted request, as demonstrated by the /./account/index.jsp URI.
CVE-2010-3700 Medium 2010-10-29 No exploit published No public exploit VMware SpringSource Spring Security 2.x before 2.0.6 and 3.x before 3.0.4, and Acegi Security 1.0.0 through 1.0.7, as used in IBM WebSphere Application Server (WAS) 6.1 and 7.0, allows remote attackers to bypass security constraints via a path parameter.
‹ prev page 2 of 2 next ›