Overview 9 matches · 2 protected · 0 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
Protected by Waratek
2
22.2%
Rule in development
0
0.0%
Mitigation candidate
7
77.8%
No exploit published
0
0.0%
blocked by ARMR today
2
22.2%
partly blocked
0
0.0%
not blocked
7
77.8%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
2
22.2%
Proof of concept only
7
77.8%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 4 / year
20111
Mitigation candidate1
High1
not blocked1
Working exploit published1
20120
20130
20140
20150
20161
Mitigation candidate1
High1
not blocked1
Working exploit published1
20170
20180
20190
20204
Protected by Waratek1
Mitigation candidate3
High4
blocked by ARMR today1
not blocked3
Proof of concept only4
20213
Protected by Waratek1
Mitigation candidate2
High3
blocked by ARMR today1
not blocked2
Proof of concept only3
20112012201320142015201620172018201920202021
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-36179 | High | 2021-01-07 | Mitigation candidate | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS. |
| CVE-2020-36188 | High | 2021-01-06 | Protected by Waratek | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. |
| CVE-2020-36184 | High | 2021-01-06 | Mitigation candidate | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource. |
| CVE-2020-35728 | High | 2020-12-27 | Mitigation candidate | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl). |
| CVE-2020-4464 | High | 2020-07-17 | Protected by Waratek | Proof of concept only | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code on a system with a specially-crafted sequence of serialized objects over the SOAP connector. IBM X-Force ID: 181489. |
| CVE-2020-4276 | High | 2020-03-26 | Mitigation candidate | Proof of concept only | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 traditional is vulnerable to a privilege escalation vulnerability when using token-based authentication in an admin request over the SOAP connector. X-Force ID: 175984. |
| CVE-2020-10673 | High | 2020-03-18 | Mitigation candidate | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus). |
| CVE-2016-0793 | High | 2016-04-01 | Mitigation candidate | Working exploit published | Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1) WEB-INF or (2) META-INF directory via a request that contains (a) lowercase or (b) "meaningless" characters. |
| CVE-2011-0807 | High | 2011-04-20 | Mitigation candidate | Working exploit published | Unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration. |