WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product communications application session controller✕Has a public PoC✕
Overview 6 matches · 1 in Waratek scope · 1 protected · 3 exploited · 1 CISA KEV
6matches 1in Waratek scope16.7% 1protected16.7% 3exploited50.0% 1CISA KEV16.7%
Protected by Waratek 1 16.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 5 83.3% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 1 16.7% High 2 33.3% Medium 3 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 16.7% partly blocked 0 0.0% not blocked 5 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 50.0% Working exploit published 3 50.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / quarter
Outside Waratek scope: 5Protected by Waratek: 1 Medium: 3High: 2Critical: 1 not blocked: 5blocked by ARMR today: 1 Working exploit published: 3Exploited: 3
Q1 151 Outside Waratek scope1 High1 not blocked1 Working exploit published1 Q2 150 Q3 150 Q4 150 Q1 160 Q2 160 Q3 160 Q4 160 Q1 170 Q2 172 Protected by Waratek1 Outside Waratek scope1 Critical1 High1 blocked by ARMR today1 not blocked1 Exploited1 Working exploit published1 Q3 170 Q4 170 Q1 180 Q2 180 Q3 180 Q4 181 Outside Waratek scope1 Medium1 not blocked1 Working exploit published1 Q1 190 Q2 191 Outside Waratek scope1 Medium1 not blocked1 Exploited1 Q3 190 Q4 190 Q1 200 Q2 201 Outside Waratek scope1 Medium1 not blocked1 Exploited1
Q2 15Q4 15Q2 16Q4 16Q2 17Q4 17Q2 18Q4 18Q2 19Q4 19Q2 20
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-11022 Medium 2020-04-29 Outside Waratek scope Exploited In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
CVE-2019-11358 Medium 2019-04-20 Outside Waratek scope Exploited jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVE-2018-11784 Medium 2018-10-04 Outside Waratek scope Working exploit published When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redirect to be generated to any URI of the attackers choice.
CVE-2017-3730 High 2017-05-04 Outside Waratek scope Working exploit published In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this can result in the client attempting to dereference a NULL pointer leading to a client crash. This could be exploited in a Denial of Service attack.
CVE-2016-8735 Critical 2017-04-06 Protected by Waratek Exploited Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.
CVE-2015-0235 High 2015-01-28 Outside Waratek scope Working exploit published Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."