Overview 115 matches · 14 in Waratek scope · 5 protected · 3 exploited · 0 CISA KEV · 13 public PoC · 5 EPSS ≥ 0.5
115matches
14in Waratek scope12.2%
5protected4.3%
3exploited2.6%
0CISA KEV0.0%
13public PoC11.3%
5EPSS ≥ 0.54.3%
Protected by Waratek
5
4.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
9
7.8%
Outside Waratek scope
1
0.9%
Not applicable
100
87.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
5
4.3%
partly blocked
0
0.0%
not blocked
110
95.7%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 24 / year
20021
Not applicable1
Medium1
not blocked1
No public exploit1
20030
20044
Not applicable4
High1
Medium3
not blocked4
No public exploit4
20051
Not applicable1
Medium1
not blocked1
No public exploit1
20061
Not applicable1
High1
not blocked1
Working exploit published1
20074
Not applicable4
High4
not blocked4
Exploited1
Working exploit published1
No public exploit2
20081
Not applicable1
High1
not blocked1
Working exploit published1
20095
Not applicable5
High3
Medium2
not blocked5
Exploited2
Working exploit published1
No public exploit2
20103
Not applicable3
High1
Low2
not blocked3
No public exploit3
20110
20123
Not applicable3
High1
Medium2
not blocked3
No public exploit3
20130
20140
20150
20160
20173
Protected by Waratek1
No exploit published2
Critical1
High2
blocked by ARMR today1
not blocked2
No public exploit3
20188
No exploit published2
Not applicable6
Critical1
High2
Medium5
not blocked8
No public exploit8
20199
Protected by Waratek1
No exploit published1
Not applicable7
Critical2
High5
Medium2
blocked by ARMR today1
not blocked8
Proof of concept only1
No public exploit8
20204
Not applicable4
Critical2
High1
Medium1
not blocked4
No public exploit4
202112
Protected by Waratek2
Not applicable10
Critical3
High6
Medium3
blocked by ARMR today2
not blocked10
Working exploit published1
Proof of concept only2
No public exploit9
202224
Outside Waratek scope1
Not applicable23
Critical3
High13
Medium8
not blocked24
Proof of concept only1
Forecast only2
No public exploit21
202317
No exploit published1
Not applicable16
Critical2
High8
Medium6
Low1
not blocked17
Proof of concept only1
Forecast only1
No public exploit15
20244
Not applicable4
Critical1
High2
Medium1
not blocked4
Proof of concept only1
No public exploit3
20251
Not applicable1
High1
not blocked1
No public exploit1
202610
Protected by Waratek1
No exploit published3
Not applicable6
High7
Medium3
blocked by ARMR today1
not blocked9
No public exploit10
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2009-1807 | High | 2009-05-28 | Not applicable | Exploited | Unspecified vulnerability in Config.dll in Baofeng products 3.09.04.17 and earlier allows remote attackers to execute arbitrary code by calling the SetAttributeValue method, as exploited in the wild in April and May 2009. |
| CVE-2009-1612 | High | 2009-05-11 | Not applicable | Exploited | Stack-based buffer overflow in the MPS.StormPlayer.1 ActiveX control in mps.dll 3.9.4.27 in Baofeng Storm allows remote attackers to execute arbitrary code via a long argument to the OnBeforeVideoDownload method, as exploited in the wild in April and May 2009. NOTE: some of these details are obtained from third party information. NOTE: it was later reported that 3.09.04.17 and earlier are also affected. |
| CVE-2008-6383 | Medium | 2009-03-02 | Not applicable | No public exploit | SQL injection vulnerability in SpeedTech Organization and Resource Manager (Storm) 5.x before 5.x-1.14 and 6.x before 6.x-1.18, a module for Drupal, allows remote authenticated users with storm project access to execute arbitrary SQL commands via unspecified vectors. |
| CVE-2008-5726 | High | 2008-12-26 | Not applicable | Working exploit published | SQL injection vulnerability in thread.php in stormBoards 1.0.1 allows remote attackers to execute arbitrary SQL commands via the id parameter. |
| CVE-2007-4943 | High | 2007-09-18 | Not applicable | No public exploit | Multiple buffer overflows in a certain ActiveX control in sparser.dll in Baofeng Storm 2.8 and earlier allow remote attackers to execute arbitrary code via malformed input in an unknown set of arguments or property values, a different DLL than CVE-2007-4816. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. |
| CVE-2007-4940 | High | 2007-09-18 | Not applicable | No public exploit | Multiple integer overflows in Media Player Classic (MPC) 6.4.9.0 and earlier, as used standalone and in mympc (aka CD-Storm) 1.0.0.1, StormPlayer 1.0.4, and possibly other products, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with certain large "indx truck size" and nEntriesInuse values. |
| CVE-2007-4939 | High | 2007-09-18 | Not applicable | Working exploit published | Heap-based buffer overflow in mplayerc.exe in Media Player Classic (MPC) 6.4.9.0 and earlier, as used standalone and in mympc (aka CD-Storm) 1.0.0.1, StormPlayer 1.0.4, and possibly other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a .avi file with an "indx truck size" of 0xffffffff, and certain wLongsPerEntry and nEntriesInuse values. |
| CVE-2007-4816 | High | 2007-09-11 | Not applicable | Exploited | Multiple buffer overflows in the BaoFeng2 storm ActiveX control in Mps.dll allow remote attackers to have an unknown impact via a long (1) URL, (2) backImage, or (3) titleImage property value; (4) a long first argument to the advancedOpen method; a long argument to the (5) isDVDPath or (6) rawParse method; or (7) a .smpl file with a long path attribute in an item element in a PlayList. |
| CVE-2006-5386 | High | 2006-10-18 | Not applicable | Working exploit published | PHP remote file inclusion vulnerability in process.php in NuralStorm Webmail 0.98b and earlier, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the DEFAULT_SKIN parameter. |
| CVE-2004-1112 | Medium | 2005-01-10 | Not applicable | No public exploit | The buffer overflow trigger in Cisco Security Agent (CSA) before 4.0.3 build 728 waits five minutes for a user response before terminating the process, which could allow remote attackers to bypass the buffer overflow protection by sending additional buffer overflow attacks within the five minute timeout period. |
| CVE-2004-1566 | Medium | 2004-12-31 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in index.php in Silent Storm Portal 2.1 and 2.2 allows remote attackers to execute arbitrary web script or HTML via the module parameter. |
| CVE-2004-0112 | Medium | 2004-11-23 | Not applicable | No public exploit | The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets during a handshake, which allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that causes an out-of-bounds read. |
| CVE-2004-0081 | Medium | 2004-11-23 | Not applicable | No public exploit | OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as demonstrated using the Codenomicon TLS Test Tool. |
| CVE-2004-0079 | High | 2004-11-23 | Not applicable | No public exploit | The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a crafted SSL/TLS handshake that triggers a null dereference. |
| CVE-2002-1832 | Medium | 2002-12-31 | Not applicable | No public exploit | Unknown vulnerability in the "ipopts decode" functionality in Firestorm IDS 0.4.0 through 0.4.2 allows remote attackers to cause a denial of service (crash) via certain IP options. |