Overview 46 matches · 0 in Waratek scope · 0 protected · 3 exploited · 0 CISA KEV · 10 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
2.2%
Not applicable
45
97.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
46
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
3
6.5%
Working exploit published
41
89.1%
Proof of concept only
2
4.3%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 5 / year
19973
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
19983
Not applicable3
High1
Medium1
Low1
not blocked3
Working exploit published3
19994
Not applicable4
High1
Medium2
Low1
not blocked4
Working exploit published4
20004
Not applicable4
High3
Medium1
not blocked4
Working exploit published4
20014
Not applicable4
High3
Medium1
not blocked4
Exploited1
Working exploit published3
20023
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20035
Not applicable5
Critical1
High2
Medium2
not blocked5
Exploited1
Working exploit published4
20043
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20050
20061
Not applicable1
High1
not blocked1
Working exploit published1
20070
20084
Not applicable4
High3
Medium1
not blocked4
Working exploit published3
Proof of concept only1
20093
Not applicable3
High1
Medium2
not blocked3
Working exploit published3
20100
20113
Not applicable3
Medium3
not blocked3
Working exploit published3
20121
Not applicable1
High1
not blocked1
Working exploit published1
20130
20142
Outside Waratek scope1
Not applicable1
High1
Low1
not blocked2
Working exploit published1
Proof of concept only1
20150
20160
20172
Not applicable2
Critical1
High1
not blocked2
Working exploit published2
20180
20190
20200
20210
20220
20230
20241
Not applicable1
High1
not blocked1
Exploited1
1997200020032006200920122015201820212024
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-6387 | High | 2024-07-01 | Not applicable | Exploited | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. |
| CVE-2017-1000375 | Critical | 2017-06-19 | Not applicable | Working exploit published | NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, this allows attackers to more easily manipulate memory leading to arbitrary code execution. This affects NetBSD 7.1 and possibly earlier versions. |
| CVE-2016-6253 | High | 2017-01-20 | Not applicable | Working exploit published | mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox. |
| CVE-2014-8517 | High | 2014-11-17 | Not applicable | Working exploit published | The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect. |
| CVE-2014-3566 | Low | 2014-10-15 | Outside Waratek scope | Proof of concept only | The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. |
| CVE-2012-0217 | High | 2012-06-12 | Not applicable | Working exploit published | The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier. |
| CVE-2011-0418 | Medium | 2011-05-24 | Not applicable | Working exploit published | The glob implementation in Pure-FTPd before 1.0.32, and in libc in NetBSD 5.1, does not properly expand expressions containing curly brackets, which allows remote authenticated users to cause a denial of service (memory consumption) via a crafted FTP STAT command. |
| CVE-2011-0419 | Medium | 2011-05-16 | Not applicable | Working exploit published | Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the Apache Portable Runtime (APR) library before 1.4.3 and the Apache HTTP Server before 2.2.18, and in fnmatch.c in libc in NetBSD 5.1, OpenBSD 4.8, FreeBSD, Apple Mac OS X 10.6, Oracle Solaris 10, and Android, allows context-dependent attackers to cause a denial of service (CPU and memory consumption) via *? sequences in the first argument, as demonstrated by attacks against mod_autoindex in httpd. |
| CVE-2011-1547 | Medium | 2011-05-09 | Not applicable | Working exploit published | Multiple stack consumption vulnerabilities in the kernel in NetBSD 4.0, 5.0 before 5.0.3, and 5.1 before 5.1.1, when IPsec is enabled, allow remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a crafted (1) IPv4 or (2) IPv6 packet with nested IPComp headers. |
| CVE-2009-2793 | Medium | 2009-09-18 | Not applicable | Working exploit published | The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms does not properly handle a pre-commit failure of the iret instruction, which might allow local users to gain privileges via vectors related to a tempEIP pseudocode variable that is outside of the code-segment limits. |
| CVE-2009-0687 | High | 2009-08-11 | Not applicable | Working exploit published | The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload. |
| CVE-2009-0689 | Medium | 2009-07-01 | Not applicable | Working exploit published | Array index error in the (1) dtoa implementation in dtoa.c (aka pdtoa.c) and the (2) gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc, as used in multiple operating systems and products including in FreeBSD 6.4 and 7.2, NetBSD 5.0, OpenBSD 4.5, Mozilla Firefox 3.0.x before 3.0.15 and 3.5.x before 3.5.4, K-Meleon 1.5.3, SeaMonkey 1.1.8, and other products, allows context-dependent attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a large precision value in the format argument to a printf function, which triggers incorrect memory allocation and a heap-based buffer overflow during conversion to a floating-point number. |
| CVE-2008-4609 | High | 2008-10-20 | Not applicable | Proof of concept only | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. |
| CVE-2008-4247 | High | 2008-09-25 | Not applicable | Working exploit published | ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser. |
| CVE-2008-1391 | High | 2008-03-27 | Not applicable | Working exploit published | Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec. |
| CVE-2008-1215 | Medium | 2008-03-09 | Not applicable | Working exploit published | Stack-based buffer overflow in the command_Expand_Interpret function in command.c in ppp (aka user-ppp), as distributed in FreeBSD 6.3 and 7.0, OpenBSD 4.1 and 4.2, and the net/userppp package for NetBSD, allows local users to gain privileges via long commands containing "~" characters. |
| CVE-2006-6652 | High | 2006-12-20 | Not applicable | Working exploit published | Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before 20061203, and Apple Mac OS X before 2007-004, as used by the FTP daemon and tnftpd, allows remote authenticated users to execute arbitrary code via a long pathname that results from path expansion. |
| CVE-2004-2012 | High | 2004-12-31 | Not applicable | Working exploit published | The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges. |
| CVE-2004-0230 | Medium | 2004-08-18 | Not applicable | Working exploit published | TCP, when using a large Window Size, makes it easier for remote attackers to guess sequence numbers and cause a denial of service (connection loss) to persistent TCP connections by repeatedly injecting a TCP RST packet, especially in protocols that use long-lived connections, such as BGP. |
| CVE-2004-0114 | Medium | 2004-03-03 | Not applicable | Working exploit published | The shmat system call in the System V Shared Memory interface for FreeBSD 5.2 and earlier, NetBSD 1.3 and earlier, and OpenBSD 2.6 and earlier, does not properly decrement a shared memory segment's reference count when the vm_map_find function fails, which could allow local users to gain read or write access to a portion of kernel memory and gain privileges. |
| CVE-2003-0681 | High | 2003-10-06 | Not applicable | Exploited | A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences. |
| CVE-2003-0466 | Critical | 2003-08-27 | Not applicable | Working exploit published | Off-by-one error in the fb_realpath() function, as derived from the realpath function in BSD, may allow attackers to execute arbitrary code, as demonstrated in wu-ftpd 2.5.0 through 2.6.2 via commands that cause pathnames of length MAXPATHLEN+1 to trigger a buffer overflow, including (1) STOR, (2) RETR, (3) APPE, (4) DELE, (5) MKD, (6) RMD, (7) STOU, or (8) RNTO. |
| CVE-2003-0102 | Medium | 2003-03-18 | Not applicable | Working exploit published | Buffer overflow in tryelf() in readelf.c of the file command allows attackers to execute arbitrary code as the user running file, possibly via a large entity size value in an ELF header (elfhdr.e_shentsize). |
| CVE-2002-1337 | High | 2003-03-07 | Not applicable | Working exploit published | Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c. |
| CVE-2003-0001 | Medium | 2003-01-17 | Not applicable | Working exploit published | Multiple ethernet Network Interface Card (NIC) device drivers do not pad frames with null bytes, which allows remote attackers to obtain information from previous packets or kernel memory by using malformed packets, as demonstrated by Etherleak. |
| CVE-2002-1192 | Medium | 2002-10-28 | Not applicable | Working exploit published | Multiple buffer overflows in rogue on NetBSD 1.6 and earlier, FreeBSD 4.6, and possibly other operating systems, allows local users to gain "games" group privileges via malformed entries in a game save file. |
| CVE-2002-1165 | Medium | 2002-10-11 | Not applicable | Working exploit published | Sendmail Consortium's Restricted Shell (SMRSH) in Sendmail 8.12.6, 8.11.6-15, and possibly other versions after 8.11 from 5/19/1998, allows attackers to bypass the intended restrictions of smrsh by inserting additional commands after (1) "||" sequences or (2) "/" characters, which are not properly filtered or verified. |
| CVE-2002-0004 | High | 2002-02-27 | Not applicable | Working exploit published | Heap corruption vulnerability in the "at" program allows local users to execute arbitrary code via a malformed execution time, which causes at to free the same memory twice. |
| CVE-2001-0554 | High | 2001-08-14 | Not applicable | Exploited | Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function. |
| CVE-2001-1244 | Medium | 2001-07-07 | Not applicable | Working exploit published | Multiple TCP implementations could allow remote attackers to cause a denial of service (bandwidth and CPU exhaustion) by setting the maximum segment size (MSS) to a very small number and requesting large amounts of data, which generates more packets with less TCP-level data that amplify network traffic and consume more server CPU to process. |
| CVE-2001-0247 | High | 2001-06-18 | Not applicable | Working exploit published | Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3. |
| CVE-2001-0053 | High | 2001-02-12 | Not applicable | Working exploit published | One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges. |
| CVE-2000-0993 | High | 2000-12-19 | Not applicable | Working exploit published | Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd. |
| CVE-2000-0751 | High | 2000-10-20 | Not applicable | Working exploit published | mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands. |
| CVE-2000-0440 | Medium | 2000-05-01 | Not applicable | Working exploit published | NetBSD 1.4.2 and earlier allows remote attackers to cause a denial of service by sending a packet with an unaligned IP timestamp option. |
| CVE-2000-0094 | High | 2000-02-16 | Not applicable | Working exploit published | procfs in BSD systems allows local users to gain root privileges by modifying the /proc/pid/mem interface via a modified file descriptor for stderr. |
| CVE-2000-0489 | Low | 1999-09-05 | Not applicable | Working exploit published | FreeBSD, NetBSD, and OpenBSD allow an attacker to cause a denial of service by creating a large number of socket pairs using the socketpair function, setting a large buffer size via setsockopt, then writing large buffers. |
| CVE-1999-0674 | High | 1999-08-09 | Not applicable | Working exploit published | The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve. |
| CVE-1999-1518 | Medium | 1999-07-15 | Not applicable | Working exploit published | Operating systems with shared memory implementations based on BSD 4.4 code allow a user to conduct a denial of service and bypass memory limits (e.g., as specified with rlimits) using mmap or shmget to allocate memory and cause page faults. |
| CVE-1999-0433 | Medium | 1999-03-21 | Not applicable | Working exploit published | XFree86 startx command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service. |
| CVE-1999-1409 | Low | 1998-07-03 | Not applicable | Working exploit published | The at program in IRIX 6.2 and NetBSD 1.3.2 and earlier allows local users to read portions of arbitrary files by submitting the file to at with the -f argument, which generates error messages that at sends to the user via e-mail. |
| CVE-1999-0009 | High | 1998-04-08 | Not applicable | Working exploit published | Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. |
| CVE-1999-0513 | Medium | 1998-01-05 | Not applicable | Working exploit published | ICMP messages to broadcast addresses are allowed, allowing for a Smurf attack that can cause a denial of service. |
| CVE-1999-0015 | Medium | 1997-12-16 | Not applicable | Working exploit published | Teardrop IP denial of service. |
| CVE-1999-0016 | Medium | 1997-12-01 | Not applicable | Working exploit published | Land IP denial of service. |
| CVE-1999-0046 | High | 1997-02-06 | Not applicable | Working exploit published | Buffer overflow of rlogin program using TERM environmental variable. |