WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product blockchain platform✕Has a public PoC✕
Overview 9 matches · 5 in Waratek scope · 1 protected · 2 exploited · 1 CISA KEV · 5 EPSS ≥ 0.5
9matches 5in Waratek scope55.6% 1protected11.1% 2exploited22.2% 1CISA KEV11.1% 5EPSS ≥ 0.555.6%
Protected by Waratek 1 11.1% Rule in development 0 0.0% Mitigation candidate 4 44.4% No exploit published 0 0.0% Outside Waratek scope 2 22.2% Not applicable 2 22.2% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 7 77.8% Medium 2 22.2% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 11.1% partly blocked 0 0.0% not blocked 8 88.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 22.2% Working exploit published 2 22.2% Proof of concept only 5 55.6% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / month
Not applicable: 2Outside Waratek scope: 2Mitigation candidate: 4Protected by Waratek: 1 Medium: 2High: 7 not blocked: 8blocked by ARMR today: 1 Proof of concept only: 5Working exploit published: 2Exploited: 2
Apr 202 Outside Waratek scope2 Medium2 not blocked2 Exploited2 May 200 Jun 200 Jul 201 Mitigation candidate1 High1 not blocked1 Working exploit published1 Aug 200 Sep 200 Oct 200 Nov 201 Not applicable1 High1 not blocked1 Proof of concept only1 Dec 201 Mitigation candidate1 High1 not blocked1 Proof of concept only1 Jan 213 Protected by Waratek1 Mitigation candidate2 High3 blocked by ARMR today1 not blocked2 Proof of concept only3 Feb 210 Mar 210 Apr 210 May 210 Jun 211 Not applicable1 High1 not blocked1 Working exploit published1
Apr 20Jun 20Aug 20Oct 20Dec 20Feb 21Apr 21Jun 21
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-23017 High 2021-06-01 Not applicable Working exploit published A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
CVE-2020-36179 High 2021-01-07 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.commons.dbcp.cpdsadapter.DriverAdapterCPDS.
CVE-2020-36188 High 2021-01-06 Protected by Waratek Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVE-2020-36184 High 2021-01-06 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.PerUserPoolDataSource.
CVE-2020-35728 High 2020-12-27 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.oracle.wls.shaded.org.apache.xalan.lib.sql.JNDIConnectionPool (aka embedded Xalan in org.glassfish.web/javax.servlet.jsp.jstl).
CVE-2020-8277 High 2020-11-19 Not applicable Proof of concept only A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVE-2020-13935 High 2020-07-14 Mitigation candidate Working exploit published The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
CVE-2020-11023 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2020-11022 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.