WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: None✕Product debian linux✕
Overview 212 matches · 0 protected · 6 exploited · 1 CISA KEV · 23 public PoC · 11 EPSS ≥ 0.5
212matches 0protected0.0% 6exploited2.8% 1CISA KEV0.5% 23public PoC10.8% 11EPSS ≥ 0.55.2%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 25 11.8% No exploit published 187 88.2%
Critical 22 10.4% High 106 50.0% Medium 69 32.5% Low 15 7.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 212 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 6 2.8% Working exploit published 6 2.8% Proof of concept only 19 9.0% Forecast only 5 2.4% No public exploit 176 83.0%
split by peak 46 / year
No exploit published: 187Mitigation candidate: 25 Low: 15Medium: 69High: 106Critical: 22 not blocked: 212 No public exploit: 176Forecast only: 5Proof of concept only: 19Working exploit published: 6Exploited: 6
20091 No exploit published1 Medium1 not blocked1 No public exploit1 20100 20110 20120 20130 20142 No exploit published2 High1 Low1 not blocked2 No public exploit2 20153 No exploit published3 Medium3 not blocked3 No public exploit3 20165 No exploit published5 High3 Medium2 not blocked5 No public exploit5 201715 No exploit published15 Critical3 High9 Medium3 not blocked15 No public exploit15 201814 No exploit published14 Critical2 High6 Medium6 not blocked14 No public exploit14 201919 No exploit published19 Critical4 High6 Medium7 Low2 not blocked19 No public exploit19 202042 Mitigation candidate10 No exploit published32 Critical9 High22 Medium7 Low4 not blocked42 Exploited3 Working exploit published1 Proof of concept only5 Forecast only2 No public exploit31 202146 Mitigation candidate7 No exploit published39 High35 Medium9 Low2 not blocked46 Exploited2 Working exploit published3 Proof of concept only2 Forecast only3 No public exploit36 202238 Mitigation candidate4 No exploit published34 Critical2 High15 Medium19 Low2 not blocked38 Working exploit published1 Proof of concept only8 No public exploit29 202316 Mitigation candidate3 No exploit published13 Critical1 High5 Medium9 Low1 not blocked16 Exploited1 Working exploit published1 Proof of concept only1 No public exploit13 202410 Mitigation candidate1 No exploit published9 Critical1 High4 Medium2 Low3 not blocked10 Proof of concept only3 No public exploit7 20251 No exploit published1 Medium1 not blocked1 No public exploit1
200920112013201520172019202120232025
212 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2017-5617 High 2017-03-16 No exploit published No public exploit The SVG Salamander (aka svgSalamander) library, when used in a web application, allows remote attackers to conduct server-side request forgery (SSRF) attacks via an xlink:href attribute in an SVG file.
CVE-2016-6801 High 2016-09-21 No exploit published No public exploit Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x before 2.6.6, 2.8.x before 2.8.3, 2.10.x before 2.10.4, 2.12.x before 2.12.4, and 2.13.x before 2.13.3 allows remote attackers to hijack the authentication of unspecified victims for requests that create a resource via an HTTP POST request with a (1) missing or (2) crafted Content-Type header.
CVE-2016-3092 High 2016-07-04 No exploit published No public exploit The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.
CVE-2016-0763 Medium 2016-02-25 No exploit published No public exploit The setGlobalContext method in org/apache/naming/factory/ResourceLinkFactory.java in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M3 does not consider whether ResourceLinkFactory.setGlobalContext callers are authorized, which allows remote authenticated users to bypass intended SecurityManager restrictions and read or write to arbitrary application data, or cause a denial of service (application disruption), via a web application that sets a crafted global context.
CVE-2016-0706 Medium 2016-02-25 No exploit published No public exploit Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application.
CVE-2015-5351 High 2016-02-25 No exploit published No public exploit The (1) Manager and (2) Host Manager applications in Apache Tomcat 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 establish sessions and send CSRF tokens for arbitrary new requests, which allows remote attackers to bypass a CSRF protection mechanism by using a token.
CVE-2014-7810 Medium 2015-06-07 No exploit published No public exploit The Expression Language (EL) implementation in Apache Tomcat 6.x before 6.0.44, 7.x before 7.0.58, and 8.x before 8.0.16 does not properly consider the possibility of an accessible interface implemented by an inaccessible class, which allows attackers to bypass a SecurityManager protection mechanism via a web application that leverages use of incorrect privileges during EL evaluation.
CVE-2015-0410 Medium 2015-01-21 No exploit published No public exploit Unspecified vulnerability in the Java SE, Java SE Embedded, JRockit component in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows remote attackers to affect availability via unknown vectors related to Security.
CVE-2015-0383 Medium 2015-01-21 No exploit published No public exploit Unspecified vulnerability in Oracle Java SE 5.0u75, 6u85, 7u72, and 8u25; Java SE Embedded 7u71 and 8u6; and JRockit R27.8.4 and R28.3.4 allows local users to affect integrity and availability via unknown vectors related to Hotspot.
CVE-2014-2398 Low 2014-04-16 No exploit published No public exploit Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JavaFX 2.2.51; and JRockit R27.8.1 and R28.3.1 allows remote authenticated users to affect integrity via unknown vectors related to Javadoc.
CVE-2014-0429 High 2014-04-16 No exploit published No public exploit Unspecified vulnerability in Oracle Java SE 5.0u61, 6u71, 7u51, and 8; JRockit R27.8.1 and R28.3.1; and Java SE Embedded 7u51 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D.
CVE-2009-2625 Medium 2009-08-06 No exploit published No public exploit XMLScanner.java in Apache Xerces2 Java, as used in Sun Java Runtime Environment (JRE) in JDK and JRE 6 before Update 15 and JDK and JRE 5.0 before Update 20, and in other products, allows remote attackers to cause a denial of service (infinite loop and application hang) via malformed XML input, as demonstrated by the Codenomicon XML fuzzing framework.
‹ prev page 3 of 3 next ›