WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product ignite✕Has a public PoC✕
Overview 6 matches · 1 in Waratek scope · 1 protected · 1 exploited · 1 CISA KEV · 2 EPSS ≥ 0.5
6matches 1in Waratek scope16.7% 1protected16.7% 1exploited16.7% 1CISA KEV16.7% 2EPSS ≥ 0.533.3%
Protected by Waratek 1 16.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 5 83.3% Withdrawn CVE 0 0.0%
Critical 3 50.0% High 1 16.7% Medium 2 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 16.7% partly blocked 0 0.0% not blocked 5 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 16.7% Working exploit published 4 66.7% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 5Protected by Waratek: 1 Medium: 2High: 1Critical: 3 not blocked: 5blocked by ARMR today: 1 Proof of concept only: 1Working exploit published: 4Exploited: 1
20091 Not applicable1 High1 not blocked1 Working exploit published1 20100 20110 20120 20130 20140 20150 20160 20172 Not applicable2 Critical2 not blocked2 Working exploit published2 20181 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20190 20201 Not applicable1 Medium1 not blocked1 Working exploit published1 20211 Not applicable1 Medium1 not blocked1 Proof of concept only1
2009201120132015201720192021
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-38699 Medium 2021-08-15 Not applicable Proof of concept only TastyIgniter 3.0.7 allows XSS via /account, /reservation, /admin/dashboard, and /admin/system_logs.
CVE-2012-1915 Medium 2020-01-09 Not applicable Working exploit published EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.
CVE-2018-1273 Critical 2018-04-11 Protected by Waratek Exploited Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.
CVE-2014-8686 Critical 2017-09-19 Not applicable Working exploit published CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.
CVE-2014-8684 Critical 2017-09-19 Not applicable Working exploit published CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 make it easier for remote attackers to spoof session cookies and consequently conduct PHP object injection attacks by leveraging use of standard string comparison operators to compare cryptographic hashes.
CVE-2008-6182 High 2009-02-19 Not applicable Working exploit published SQL injection vulnerability in the Ignite Gallery (com_ignitegallery) component 0.8.0 through 0.8.3 for Joomla! allows remote attackers to execute arbitrary SQL commands via the gallery parameter in a view action to index.php.