WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product case✕Has a public PoC✕
Overview 11 matches · 3 in Waratek scope · 3 protected · 3 exploited · 2 CISA KEV · 3 EPSS ≥ 0.5
11matches 3in Waratek scope27.3% 3protected27.3% 3exploited27.3% 2CISA KEV18.2% 3EPSS ≥ 0.527.3%
Protected by Waratek 3 27.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 8 72.7% Withdrawn CVE 0 0.0%
Critical 2 18.2% High 3 27.3% Medium 6 54.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 27.3% partly blocked 0 0.0% not blocked 8 72.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 27.3% Working exploit published 8 72.7% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 8Protected by Waratek: 3 Medium: 6High: 3Critical: 2 not blocked: 8blocked by ARMR today: 3 Working exploit published: 8Exploited: 3
19991 Not applicable1 Medium1 not blocked1 Working exploit published1 20000 20011 Not applicable1 High1 not blocked1 Working exploit published1 20021 Not applicable1 Medium1 not blocked1 Working exploit published1 20030 20040 20050 20060 20070 20081 Not applicable1 Medium1 not blocked1 Working exploit published1 20091 Not applicable1 High1 not blocked1 Working exploit published1 20101 Not applicable1 Medium1 not blocked1 Working exploit published1 20110 20120 20131 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20140 20150 20160 20171 Not applicable1 Medium1 not blocked1 Working exploit published1 20180 20190 20200 20211 Not applicable1 Medium1 not blocked1 Working exploit published1 20222 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited2
200020022004200620082010201220142016201820202022
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-22965 Critical 2022-04-01 Protected by Waratek Exploited A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2022-22963 Critical 2022-04-01 Protected by Waratek Exploited In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2021-38704 Medium 2021-09-07 Not applicable Working exploit published Multiple reflected cross-site scripting (XSS) vulnerabilities in ClinicCases 7.3.3 allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft.
CVE-2017-5631 Medium 2017-05-01 Not applicable Working exploit published An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter (i.e., "usr") that is transmitted in the login.php query string.
CVE-2013-1965 High 2013-07-10 Protected by Waratek Exploited Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.3, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
CVE-2010-0943 Medium 2010-03-08 Not applicable Working exploit published Directory traversal vulnerability in the JA Showcase (com_jashowcase) component for Joomla! allows remote attackers to read arbitrary files via a .. (dot dot) in the controller parameter in a jashowcase action to index.php.
CVE-2009-3499 High 2009-09-30 Not applicable Working exploit published SQL injection vulnerability in employee.aspx in BPowerHouse BPLawyerCaseDocuments 1.0 allows remote attackers to execute arbitrary SQL commands via the cat parameter.
CVE-2008-3390 Medium 2008-07-31 Not applicable Working exploit published Directory traversal vulnerability in libraries/general.init.php in Minishowcase Image Gallery 09b136, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CVE-2002-1322 Medium 2002-12-11 Not applicable Working exploit published Rational ClearCase 4.1, 2002.05, and possibly other versions allows remote attackers to cause a denial of service (crash) via certain packets to port 371, e.g. via nmap.
CVE-2001-0855 High 2001-12-06 Not applicable Working exploit published Buffer overflow in db_loader in ClearCase 4.2 and earlier allows local users to gain root privileges via a long TERM environment variable.
CVE-1999-0350 Medium 1999-02-08 Not applicable Working exploit published Race condition in the db_loader program in ClearCase gives local users root access by setting SUID bits.