WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product quality✕Has a public PoC✕
Overview 6 matches · 1 in Waratek scope · 1 protected · 1 exploited · 1 CISA KEV · 3 EPSS ≥ 0.5
6matches 1in Waratek scope16.7% 1protected16.7% 1exploited16.7% 1CISA KEV16.7% 3EPSS ≥ 0.550.0%
Protected by Waratek 1 16.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 16.7% Not applicable 4 66.7% Withdrawn CVE 0 0.0%
Critical 2 33.3% High 2 33.3% Medium 2 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 16.7% partly blocked 0 0.0% not blocked 5 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 16.7% Working exploit published 5 83.3% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 4Outside Waratek scope: 1Protected by Waratek: 1 Medium: 2High: 2Critical: 2 not blocked: 5blocked by ARMR today: 1 Working exploit published: 5Exploited: 1
20072 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20080 20090 20101 Not applicable1 Medium1 not blocked1 Working exploit published1 20110 20120 20130 20140 20151 Not applicable1 High1 not blocked1 Working exploit published1 20160 20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20180 20190 20200 20210 20220 20230 20240 20250 20261 Outside Waratek scope1 Critical1 not blocked1 Exploited1
2008201020122014201620182020202220242026
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-111497 Critical 2026-10-22 Outside Waratek scope Exploited A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.
CVE-2014-9566 High 2015-03-10 Not applicable Working exploit published Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager (NCM) before 7.3.2, IP Address Manager (IPAM) before 4.3, User Device Tracker (UDT) before 3.2, VoIP & Network Quality Manager (VNQM) before 4.2, Server & Application Manager (SAM) before 6.2, Web Performance Monitor (WPM) before 2.2, and possibly other Solarwinds products, allow remote authenticated users to execute arbitrary SQL commands via the (1) dir or (2) sort parameter to the (a) GetAccounts or (b) GetAccountGroups endpoint.
CVE-2010-4094 Medium 2010-10-26 Not applicable Working exploit published The Tomcat server in IBM Rational Quality Manager and Rational Test Lab Manager has a default password for the ADMIN account, which makes it easier for remote attackers to execute arbitrary code by leveraging access to the manager role. NOTE: this might overlap CVE-2009-3548.
CVE-2007-1882 Medium 2007-04-06 Not applicable Working exploit published qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment in HP Mercury Quality Center 9.0 build 9.1.0.4352 allows remote authenticated users to execute arbitrary SQL commands via the RunQuery method.
CVE-2007-1819 High 2007-04-02 Not applicable Working exploit published Stack-based buffer overflow in the SPIDERLib.Loader ActiveX control (Spider90.ocx) 9.1.0.4353 in TestDirector (TD) for Mercury Quality Center 9.0 before Patch 12.1, and 8.2 SP1 before Patch 32, allows remote attackers to execute arbitrary code via a long ProgColor property.