WaratekVRT Sign in
Reset
More filters (2)
Columns
Product console✕Has a public PoC✕
Overview 9 matches · 3 protected · 2 exploited · 0 CISA KEV · 4 EPSS ≥ 0.5
9matches 3protected33.3% 2exploited22.2% 0CISA KEV0.0% 4EPSS ≥ 0.544.4%
Protected by Waratek 3 33.3% Rule in development 0 0.0% Mitigation candidate 6 66.7% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 9 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 33.3% partly blocked 0 0.0% not blocked 6 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 22.2% Working exploit published 6 66.7% Proof of concept only 1 11.1% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Mitigation candidate: 6Protected by Waratek: 3 Medium: 9 not blocked: 6blocked by ARMR today: 3 Proof of concept only: 1Working exploit published: 6Exploited: 2
20061 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20070 20080 20092 Mitigation candidate2 Medium2 not blocked2 Working exploit published2 20101 Mitigation candidate1 Medium1 not blocked1 Working exploit published1 20110 20120 20130 20140 20150 20160 20171 Protected by Waratek1 Medium1 blocked by ARMR today1 Working exploit published1 20181 Mitigation candidate1 Medium1 not blocked1 Exploited1 20190 20200 20213 Protected by Waratek2 Mitigation candidate1 Medium3 blocked by ARMR today2 not blocked1 Exploited1 Working exploit published1 Proof of concept only1
20072009201120132015201720192021
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-45105 Medium 2021-12-18 Protected by Waratek Exploited Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2021-2471 Medium 2021-10-20 Mitigation candidate Proof of concept only Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).
CVE-2021-28164 Medium 2021-04-01 Protected by Waratek Working exploit published In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVE-2018-8006 Medium 2018-10-10 Mitigation candidate Exploited An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the queue.jsp page of Apache ActiveMQ versions 5.0.0 to 5.15.5. The root cause of this issue is improper data filtering of the QueueFilter parameter.
CVE-2017-10355 Medium 2017-10-19 Protected by Waratek Working exploit published Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2010-1587 Medium 2010-04-28 Mitigation candidate Working exploit published The Jetty ResourceHandler in Apache ActiveMQ 5.x before 5.3.2 and 5.4.x before 5.4.0 allows remote attackers to read JSP source code via a // (slash slash) initial substring in a URI for (1) admin/index.jsp, (2) admin/queues.jsp, or (3) admin/topics.jsp.
CVE-2009-0039 Medium 2009-04-17 Mitigation candidate Working exploit published Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to hijack the authentication of administrators for requests that (1) change the web administration password, (2) upload applications, and perform unspecified other administrative actions, as demonstrated by (3) a Shutdown request to console/portal//Server/Shutdown.
CVE-2009-0038 Medium 2009-04-17 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in the web administration console in Apache Geronimo Application Server 2.1 through 2.1.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name, (2) ip, (3) username, or (4) description parameter to console/portal/Server/Monitoring; or (5) the PATH_INFO to the default URI under console/portal/.
CVE-2006-0254 Medium 2006-01-18 Mitigation candidate Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in Apache Geronimo 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) time parameter to cal2.jsp and (2) any invalid parameter, which causes an XSS when the log file is viewed by the Web-Access-Log viewer.