WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product advisor✕Has a public PoC✕
Overview 9 matches · 4 in Waratek scope · 1 protected · 3 exploited · 3 CISA KEV · 3 EPSS ≥ 0.5
9matches 4in Waratek scope44.4% 1protected11.1% 3exploited33.3% 3CISA KEV33.3% 3EPSS ≥ 0.533.3%
Protected by Waratek 4 44.4% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 5 55.6% Withdrawn CVE 0 0.0%
Critical 1 11.1% High 7 77.8% Medium 1 11.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 11.1% partly blocked 3 33.3% not blocked 5 55.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 33.3% Working exploit published 5 55.6% Proof of concept only 1 11.1% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 5Protected by Waratek: 4 Medium: 1High: 7Critical: 1 not blocked: 5partly blocked: 3blocked by ARMR today: 1 Proof of concept only: 1Working exploit published: 5Exploited: 3
20071 Not applicable1 High1 not blocked1 Working exploit published1 20080 20090 20100 20110 20122 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20130 20140 20150 20161 Protected by Waratek1 Critical1 partly blocked1 Exploited1 20172 Protected by Waratek2 High2 partly blocked2 Exploited2 20180 20192 Protected by Waratek1 Not applicable1 High2 blocked by ARMR today1 not blocked1 Working exploit published1 Proof of concept only1 20200 20210 20220 20231 Not applicable1 High1 not blocked1 Working exploit published1
200720092011201320152017201920212023
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-0261 High 2023-02-13 Not applicable Working exploit published The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
CVE-2019-14439 High 2019-07-30 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2018-6443 High 2019-01-22 Not applicable Working exploit published A vulnerability in Brocade Network Advisor Versions before 14.3.1 could allow an unauthenticated, remote attacker to log in to the JBoss Administration interface of an affected system using an undocumented user credentials and install additional JEE applications. A remote unauthenticated user who has access to Network Advisor client libraries and able to decrypt the Jboss credentials could gain access to the Jboss web console.
CVE-2017-12617 High 2017-10-04 Protected by Waratek Exploited When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2017-12615 High 2017-09-19 Protected by Waratek Exploited When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2016-4437 Critical 2016-06-07 Protected by Waratek Exploited Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
CVE-2012-0407 Medium 2012-04-20 Not applicable Working exploit published Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (infinite loop) via a negative 64-bit value in a certain size field.
CVE-2012-0406 High 2012-04-20 Not applicable Working exploit published The DPA_Utilities.cProcessAuthenticationData function in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an AUTHENTICATECONNECTION command that (1) lacks a password field or (2) has an empty password.
CVE-2007-3882 High 2007-07-18 Not applicable Working exploit published SQL injection vulnerability in index.php in Expert Advisor allows remote attackers to execute arbitrary SQL commands via the id parameter.