WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product apollo✕Has a public PoC✕
Overview 7 matches · 3 in Waratek scope · 1 protected · 1 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
7matches 3in Waratek scope42.9% 1protected14.3% 1exploited14.3% 0CISA KEV0.0% 1EPSS ≥ 0.514.3%
Protected by Waratek 1 14.3% Rule in development 0 0.0% Mitigation candidate 2 28.6% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 4 57.1% Withdrawn CVE 0 0.0%
Critical 1 14.3% High 3 42.9% Medium 3 42.9% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 14.3% partly blocked 0 0.0% not blocked 6 85.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 6 85.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Not applicable: 4Mitigation candidate: 2Protected by Waratek: 1 Medium: 3High: 3Critical: 1 not blocked: 6blocked by ARMR today: 1 Working exploit published: 6Exploited: 1
20091 Not applicable1 High1 not blocked1 Working exploit published1 20100 20110 20120 20130 20140 20150 20160 20170 20180 20193 Protected by Waratek1 Mitigation candidate2 Medium3 blocked by ARMR today1 not blocked2 Working exploit published3 20200 20210 20220 20230 20243 Not applicable3 Critical1 High2 not blocked3 Exploited1 Working exploit published2
20102012201420162018202020222024
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-25736 High 2024-03-27 Not applicable Working exploit published An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can restart the device via a /device/reboot GET request.
CVE-2024-25735 Critical 2024-03-27 Not applicable Exploited An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request.
CVE-2024-25734 High 2024-03-27 Not applicable Working exploit published An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered, which might make it easier for remote attackers to enumerate user accounts.
CVE-2019-13237 Medium 2019-08-27 Protected by Waratek Working exploit published In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp.
CVE-2019-13235 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form.
CVE-2019-13234 Medium 2019-08-27 Mitigation candidate Working exploit published In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine.
CVE-2009-1351 High 2009-04-21 Not applicable Working exploit published Heap-based buffer overflow in Apollo 37zz allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long URI in a playlist (.m3u) file.