WaratekVRT Sign in
Reset
More filters (1)
Columns
Published from 2019-06-01✕
Overview 212 matches · 0 protected · 72 exploited · 5 CISA KEV · 188 public PoC · 50 EPSS ≥ 0.5
212matches 0protected0.0% 72exploited34.0% 5CISA KEV2.4% 188public PoC88.7% 50EPSS ≥ 0.523.6%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 212 100.0% No exploit published 0 0.0%
Critical 73 34.4% High 66 31.1% Medium 71 33.5% Low 2 0.9% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 205 96.7% not established 7 3.3% unrecorded 0 0.0%
Exploited 72 34.0% Working exploit published 93 43.9% Proof of concept only 41 19.3% Forecast only 0 0.0% No public exploit 6 2.8%
split by peak 40 / year
Mitigation candidate: 212 Low: 2Medium: 71High: 66Critical: 73 not established: 7not blocked: 205 No public exploit: 6Proof of concept only: 41Working exploit published: 93Exploited: 72
201912 Mitigation candidate12 Critical2 High3 Medium7 not blocked11 not established1 Exploited3 Working exploit published8 Proof of concept only1 202034 Mitigation candidate34 Critical11 High8 Medium15 not blocked34 Exploited10 Working exploit published14 Proof of concept only9 No public exploit1 202124 Mitigation candidate24 Critical4 High9 Medium11 not blocked24 Exploited9 Working exploit published8 Proof of concept only7 202221 Mitigation candidate21 Critical10 High8 Medium3 not blocked21 Exploited3 Working exploit published7 Proof of concept only10 No public exploit1 202340 Mitigation candidate40 Critical17 High13 Medium10 not blocked38 not established2 Exploited11 Working exploit published25 Proof of concept only3 No public exploit1 202429 Mitigation candidate29 Critical11 High12 Medium5 Low1 not blocked29 Exploited12 Working exploit published12 Proof of concept only5 202525 Mitigation candidate25 Critical8 High3 Medium14 not blocked23 not established2 Exploited17 Working exploit published8 202627 Mitigation candidate27 Critical10 High10 Medium6 Low1 not blocked25 not established2 Exploited7 Working exploit published11 Proof of concept only6 No public exploit3
20192020202120222023202420252026
212 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 3 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2012-1592 High 2019-12-05 Mitigation candidate Working exploit published A local code execution issue exists in Apache Struts2 when processing malformed XSLT files, which could let a malicious user upload and execute arbitrary files.
CVE-2019-12409 Critical 2019-11-18 Mitigation candidate Proof of concept only The 8.1.1 and 8.2.0 releases of Apache Solr contain an insecure setting for the ENABLE_REMOTE_JMX_OPTS configuration option in the default solr.in.sh configuration file shipping with Solr. If you use the default solr.in.sh file from the affected releases, then JMX monitoring will be enabled and exposed on RMI_PORT (default=18983), without any authentication. If this port is opened for inbound traffic in your firewall, then anyone with network access to your Solr nodes will be able to access JMX, which may in turn allow them to upload malicious code for execution on the Solr server.
CVE-2011-3923 Critical 2019-11-01 Mitigation candidate Exploited Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2019-10475 Medium 2019-10-23 Mitigation candidate Working exploit published A reflected cross-site scripting vulnerability in Jenkins build-metrics Plugin allows attackers to inject arbitrary HTML and JavaScript into web pages provided by this plugin.
CVE-2019-10405 Medium 2019-09-25 Mitigation candidate Working exploit published Jenkins 2.196 and earlier, LTS 2.176.3 and earlier printed the value of the "Cookie" HTTP request header on the /whoAmI/ URL, allowing attackers exploiting another XSS vulnerability to obtain the HTTP session cookie despite it being marked HttpOnly.
CVE-2019-13236 Medium 2019-08-27 Mitigation candidate Working exploit published In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple Reflected and Stored XSS issues in the management interface.
CVE-2019-13235 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
CVE-2019-13234 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
CVE-2019-2768 High 2019-07-23 Mitigation candidate Exploited Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected is 11.1.1.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2019-2767 High 2019-07-23 Mitigation candidate Exploited Vulnerability in the BI Publisher (formerly XML Publisher) component of Oracle Fusion Middleware (subcomponent: BI Publisher Security). The supported version that is affected are 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise BI Publisher (formerly XML Publisher). While the vulnerability is in BI Publisher (formerly XML Publisher), attacks may significantly impact additional products. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of BI Publisher (formerly XML Publisher) accessible data as well as unauthorized read access to a subset of BI Publisher (formerly XML Publisher) accessible data. CVSS 3.0 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
CVE-2019-11269 Medium 2019-06-12 Mitigation candidate Working exploit published Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.
CVE-2019-6588 Medium 2019-06-03 Mitigation candidate Working exploit published In Liferay Portal before 7.1 CE GA4, an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the "url" parameter of the JSP taglib call <liferay-ui:captcha url="<%= url %>" /> or <liferay-captcha:captcha url="<%= url %>" />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.
‹ prev page 3 of 3 next ›