WaratekVRT Sign in
Reset
More filters (2)
Columns
Product tics✕Has a public PoC✕
Overview 7 matches · 4 protected · 4 exploited · 3 CISA KEV · 5 EPSS ≥ 0.5
7matches 4protected57.1% 4exploited57.1% 3CISA KEV42.9% 5EPSS ≥ 0.571.4%
Protected by Waratek 4 57.1% Rule in development 0 0.0% Mitigation candidate 3 42.9% No exploit published 0 0.0%
Critical 0 0.0% High 7 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 57.1% partly blocked 0 0.0% not blocked 3 42.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 57.1% Working exploit published 0 0.0% Proof of concept only 3 42.9% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 3 / year
Mitigation candidate: 3Protected by Waratek: 4 High: 7 not blocked: 3blocked by ARMR today: 4 Proof of concept only: 3Exploited: 4
20141 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20150 20160 20170 20180 20191 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 20201 Mitigation candidate1 High1 not blocked1 Proof of concept only1 20211 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20220 20233 Protected by Waratek1 Mitigation candidate2 High3 blocked by ARMR today1 not blocked2 Exploited2 Proof of concept only1
2014201520162017201820192020202120222023
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-31419 High 2023-10-26 Mitigation candidate Proof of concept only A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service.
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-43769 High 2023-04-03 Protected by Waratek Exploited Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
CVE-2021-4104 High 2021-12-14 Protected by Waratek Exploited JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2020-10673 High 2020-03-18 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVE-2019-14439 High 2019-07-30 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2014-3120 High 2014-07-28 Protected by Waratek Exploited The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.