WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor squid-cache✕
Overview 111 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 5 public PoC · 20 EPSS ≥ 0.5
111matches 0in Waratek scope0.0% 0protected0.0% 1exploited0.9% 0CISA KEV0.0% 5public PoC4.5% 20EPSS ≥ 0.518.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 8 7.2% Not applicable 103 92.8% Withdrawn CVE 0 0.0%
Critical 11 9.9% High 48 43.2% Medium 50 45.0% Low 2 1.8% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 111 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 0.9% Working exploit published 1 0.9% Proof of concept only 5 4.5% Forecast only 16 14.4% No public exploit 88 79.3%
split by peak 17 / year
Not applicable: 103Outside Waratek scope: 8 Low: 2Medium: 50High: 48Critical: 11 not blocked: 111 No public exploit: 88Forecast only: 16Proof of concept only: 5Working exploit published: 1Exploited: 1
20051 Not applicable1 High1 not blocked1 No public exploit1 20060 20070 20080 20093 Not applicable3 Medium3 not blocked3 Forecast only1 No public exploit2 20104 Not applicable4 Medium4 not blocked4 Forecast only1 No public exploit3 20112 Not applicable2 Medium2 not blocked2 No public exploit2 20122 Not applicable2 Medium2 not blocked2 No public exploit2 20134 Not applicable4 High2 Medium2 not blocked4 Working exploit published1 No public exploit3 20145 Not applicable5 Medium5 not blocked5 Forecast only2 No public exploit3 20154 Not applicable4 Medium3 Low1 not blocked4 No public exploit4 201615 Not applicable15 High13 Medium1 Low1 not blocked15 Proof of concept only1 Forecast only2 No public exploit12 20172 Not applicable2 High2 not blocked2 No public exploit2 20185 Not applicable5 High2 Medium3 not blocked5 Proof of concept only1 No public exploit4 201911 Not applicable11 Critical3 High4 Medium4 not blocked11 Forecast only2 No public exploit9 202017 Outside Waratek scope1 Not applicable16 Critical4 High7 Medium6 not blocked17 Forecast only1 No public exploit16 202110 Outside Waratek scope5 Not applicable5 High3 Medium7 not blocked10 Forecast only3 No public exploit7 20223 Not applicable3 High1 Medium2 not blocked3 No public exploit3 202310 Not applicable10 Critical1 High9 not blocked10 Forecast only3 No public exploit7 20245 Outside Waratek scope2 Not applicable3 High3 Medium2 not blocked5 Proof of concept only2 Forecast only1 No public exploit2 20253 Not applicable3 Critical2 Medium1 not blocked3 Exploited1 No public exploit2 20265 Not applicable5 Critical1 High1 Medium3 not blocked5 Proof of concept only1 No public exploit4
20062008201020122014201620182020202220242026
111 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2012-2213 Medium 2012-04-28 Not applicable No public exploit Squid 3.1.9 allows remote attackers to bypass the access configuration for the CONNECT method by providing an arbitrary allowed hostname in the Host HTTP header. NOTE: this issue might not be reproducible, because the researcher is unable to provide a squid.conf file for a vulnerable system, and the observed behavior is consistent with a squid.conf file that was (perhaps inadvertently) designed to allow access based on a "req_header Host" acl regex that matches www.uol.com.br
CVE-2011-4096 Medium 2011-11-17 Not applicable No public exploit The idnsGrokReply function in Squid before 3.1.16 does not properly free memory, which allows remote attackers to cause a denial of service (daemon abort) via a DNS reply containing a CNAME record that references another CNAME record that contains an empty A record.
CVE-2011-3205 Medium 2011-09-06 Not applicable No public exploit Buffer overflow in the gopherToHTML function in gopher.cc in the Gopher reply parser in Squid 3.0 before 3.0.STABLE26, 3.1 before 3.1.15, and 3.2 before 3.2.0.11 allows remote Gopher servers to cause a denial of service (memory corruption and daemon restart) or possibly have unspecified other impact via a long line in a response. NOTE: This issue exists because of a CVE-2005-0094 regression.
CVE-2010-2951 Medium 2010-10-12 Not applicable No public exploit dns_internal.cc in Squid 3.1.6, when IPv6 DNS resolution is not enabled, accesses an invalid socket during an IPv4 TCP DNS query, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via vectors that trigger an IPv4 DNS response with the TC bit set.
CVE-2010-3072 Medium 2010-09-20 Not applicable Forecast only The string-comparison functions in String.cci in Squid 3.x before 3.1.8 and 3.2.x before 3.2.0.2 allow remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
CVE-2010-0639 Medium 2010-02-15 Not applicable No public exploit The htcpHandleTstRequest function in htcp.c in Squid 2.x before 2.6.STABLE24 and 2.7 before 2.7.STABLE8, and htcp.cc in 3.0 before 3.0.STABLE24, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via crafted packets to the HTCP port.
CVE-2010-0308 Medium 2010-02-03 Not applicable No public exploit lib/rfc1035.c in Squid 2.x, 3.0 through 3.0.STABLE22, and 3.1 through 3.1.0.15 allows remote attackers to cause a denial of service (assertion failure) via a crafted DNS packet that only contains a header.
CVE-2009-2855 Medium 2009-08-18 Not applicable No public exploit The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 allows remote attackers to cause a denial of service via a crafted auth header with certain comma delimiters that trigger an infinite loop of calls to the strcspn function.
CVE-2009-2622 Medium 2009-07-28 Not applicable Forecast only Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 allows remote attackers to cause a denial of service via malformed requests including (1) "missing or mismatched protocol identifier," (2) missing or negative status value," (3) "missing version," or (4) "missing or invalid status number," related to (a) HttpMsg.cc and (b) HttpReply.cc.
CVE-2009-2621 Medium 2009-07-28 Not applicable No public exploit Squid 3.0 through 3.0.STABLE16 and 3.1 through 3.1.0.11 does not properly enforce "buffer limits and related bound checks," which allows remote attackers to cause a denial of service via (1) an incomplete request or (2) a request with a large header size, related to (a) HttpMsg.cc and (b) client_side.cc.
CVE-2005-0211 High 2005-05-02 Not applicable No public exploit Buffer overflow in wccp.c in Squid 2.5 before 2.5.STABLE7 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a long WCCP packet, which is processed by a recvfrom function call that uses an incorrect length parameter.
‹ prev page 2 of 2 next ›