WaratekVRT Sign in
Reset
More filters (2)
Columns
Product oncommand shift✕Has a public PoC✕
Overview 5 matches · 3 protected · 3 exploited · 3 CISA KEV · 3 EPSS ≥ 0.5
5matches 3protected60.0% 3exploited60.0% 3CISA KEV60.0% 3EPSS ≥ 0.560.0%
Protected by Waratek 5 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 40.0% High 2 40.0% Medium 1 20.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 60.0% partly blocked 2 40.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 60.0% Working exploit published 1 20.0% Proof of concept only 1 20.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / month
Protected by Waratek: 5 Medium: 1High: 2Critical: 2 partly blocked: 2blocked by ARMR today: 3 Proof of concept only: 1Working exploit published: 1Exploited: 3
Apr 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 May 170 Jun 170 Jul 170 Aug 170 Sep 171 Protected by Waratek1 High1 partly blocked1 Exploited1 Oct 172 Protected by Waratek2 High1 Medium1 blocked by ARMR today1 partly blocked1 Exploited1 Working exploit published1 Nov 170 Dec 170 Jan 180 Feb 181 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1
Apr 17May 17Jun 17Jul 17Aug 17Sep 17Oct 17Nov 17Dec 17Jan 18Feb 18
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2017-7525 Critical 2018-02-06 Protected by Waratek Proof of concept only A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVE-2017-10355 Medium 2017-10-19 Protected by Waratek Working exploit published Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Networking). Supported versions that are affected are Java SE: 6u161, 7u151, 8u144 and 9; Java SE Embedded: 8u144; JRockit: R28.3.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded, JRockit. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Java SE, Java SE Embedded, JRockit. Note: This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified Component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service. CVSS 3.0 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
CVE-2017-12617 High 2017-10-04 Protected by Waratek Exploited When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2017-12615 High 2017-09-19 Protected by Waratek Exploited When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2016-8735 Critical 2017-04-06 Protected by Waratek Exploited Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.