WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Product web analytics✕Has a public PoC✕
Overview 4 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 EPSS ≥ 0.5
4matches 0in Waratek scope0.0% 0protected0.0% 1exploited25.0% 0CISA KEV0.0% 1EPSS ≥ 0.525.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 4 100.0% Withdrawn CVE 0 0.0%
Critical 1 25.0% High 1 25.0% Medium 2 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 25.0% Working exploit published 3 75.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 2 / year
Not applicable: 4 Medium: 2High: 1Critical: 1 not blocked: 4 Working exploit published: 3Exploited: 1
20102 Not applicable2 Medium2 not blocked2 Working exploit published2 20110 20120 20130 20141 Not applicable1 High1 not blocked1 Working exploit published1 20150 20160 20170 20180 20190 20200 20210 20221 Not applicable1 Critical1 not blocked1 Exploited1
2010201220142016201820202022
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-24637 Critical 2022-03-18 Not applicable Exploited Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
CVE-2014-1206 High 2014-01-15 Not applicable Working exploit published SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a base.passwordResetRequest action to index.php.
CVE-2010-2677 Medium 2010-07-08 Not applicable Working exploit published PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the IP parameter. NOTE: some of these details are obtained from third party information.
CVE-2010-2676 Medium 2010-07-08 Not applicable Working exploit published Multiple directory traversal vulnerabilities in index.php in Open Web Analytics (OWA) 1.2.3 might allow remote attackers to read arbitrary files via directory traversal sequences in the (1) owa_action and (2) owa_do parameters.