WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2018-09-01✕Product java✕
Overview 212 matches · 33 protected · 0 exploited · 0 CISA KEV · 5 public PoC · 1 EPSS ≥ 0.5
212matches 33protected15.6% 0exploited0.0% 0CISA KEV0.0% 5public PoC2.4% 1EPSS ≥ 0.50.5%
Protected by Waratek 33 15.6% Rule in development 0 0.0% Mitigation candidate 2 0.9% No exploit published 177 83.5%
Critical 35 16.5% High 106 50.0% Medium 62 29.2% Low 9 4.2% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 33 15.6% partly blocked 0 0.0% not blocked 179 84.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 35 16.5% Forecast only 0 0.0% No public exploit 177 83.5%
split by peak 96 / year
No exploit published: 177Mitigation candidate: 2Protected by Waratek: 33 Low: 9Medium: 62High: 106Critical: 35 not blocked: 179blocked by ARMR today: 33 No public exploit: 177Proof of concept only: 35
20183 Protected by Waratek2 No exploit published1 Critical1 Medium2 blocked by ARMR today2 not blocked1 No public exploit3 201914 Protected by Waratek6 No exploit published8 Critical2 High3 Medium8 Low1 blocked by ARMR today6 not blocked8 Proof of concept only1 No public exploit13 202010 No exploit published10 Critical3 High5 Medium2 not blocked10 No public exploit10 202117 Protected by Waratek4 Mitigation candidate2 No exploit published11 Critical4 High5 Medium7 Low1 blocked by ARMR today4 not blocked13 Proof of concept only2 No public exploit15 202224 Protected by Waratek4 No exploit published20 Critical1 High16 Medium6 Low1 blocked by ARMR today4 not blocked20 Proof of concept only7 No public exploit17 202320 Protected by Waratek2 No exploit published18 Critical5 High11 Medium4 blocked by ARMR today2 not blocked18 Proof of concept only7 No public exploit13 202419 Protected by Waratek6 No exploit published13 Critical1 High11 Medium5 Low2 blocked by ARMR today6 not blocked13 Proof of concept only6 No public exploit13 20259 Protected by Waratek3 No exploit published6 Critical2 High5 Medium2 blocked by ARMR today3 not blocked6 Proof of concept only2 No public exploit7 202696 Protected by Waratek6 No exploit published90 Critical16 High50 Medium26 Low4 blocked by ARMR today6 not blocked90 Proof of concept only10 No public exploit86
201820192020202120222023202420252026
212 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2019-4473 High 2019-08-05 No exploit published No public exploit Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.
CVE-2019-3802 Medium 2019-06-03 No exploit published No public exploit This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.
CVE-2019-11808 Low 2019-05-07 No exploit published No public exploit Ratpack versions before 1.6.1 generate a session ID using a cryptographically weak PRNG in the JDK's ThreadLocalRandom. This means that if an attacker can determine a small window for the server start time and obtain a session ID value, they can theoretically determine the sequence of session IDs.
CVE-2019-3797 Medium 2019-05-06 Protected by Waratek No public exploit This affects Spring Data JPA in versions up to and including 2.1.5, 2.0.13 and 1.11.19. Derived queries using any of the predicates ‘startingWith’, ‘endingWith’ or ‘containing’ could return more results than anticipated when a maliciously crafted query parameter value is supplied. Also, LIKE expressions in manually defined queries could return unexpected results if the parameter values bound did not have escaped reserved characters properly.
CVE-2014-3603 Medium 2019-04-04 No exploit published No public exploit The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2019-2540 Medium 2019-01-16 No exploit published No public exploit Vulnerability in the Java Advanced Management Console component of Oracle Java SE (subcomponent: Server). The supported version that is affected is Java Advanced Management Console: 2.12. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java Advanced Management Console. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Java Advanced Management Console, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Java Advanced Management Console accessible data as well as unauthorized read access to a subset of Java Advanced Management Console accessible data. CVSS 3.0 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
CVE-2018-11788 Critical 2019-01-07 Protected by Waratek Proof of concept only Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
CVE-2019-5312 Critical 2019-01-04 Protected by Waratek No public exploit An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318.
CVE-2018-18893 Medium 2019-01-03 No exploit published No public exploit Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.
CVE-2018-1000873 Medium 2018-12-20 Protected by Waratek No public exploit Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.
CVE-2018-15531 Critical 2018-09-26 Protected by Waratek No public exploit JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
CVE-2018-11087 Medium 2018-09-14 No exploit published No public exploit Pivotal Spring AMQP, 1.x versions prior to 1.7.10 and 2.x versions prior to 2.0.6, expose a man-in-the-middle vulnerability due to lack of hostname validation. A malicious user that has the ability to intercept traffic would be able to view data in transit.
‹ prev page 3 of 3 next ›