Overview 38 matches · 6 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
38matches
6in Waratek scope15.8%
2protected5.3%
0exploited0.0%
0CISA KEV0.0%
1public PoC2.6%
0EPSS ≥ 0.50.0%
Protected by Waratek
2
5.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
4
10.5%
Outside Waratek scope
0
0.0%
Not applicable
32
84.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
2
5.3%
partly blocked
0
0.0%
not blocked
36
94.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
2.6%
Proof of concept only
3
7.9%
Forecast only
0
0.0%
No public exploit
34
89.5%
split by
peak 7 / year
20001
Not applicable1
Medium1
not blocked1
No public exploit1
20010
20020
20030
20040
20050
20060
20070
20080
20090
20100
20110
20122
Not applicable2
Medium2
not blocked2
Working exploit published1
No public exploit1
20131
Not applicable1
Medium1
not blocked1
No public exploit1
20142
Not applicable2
Medium2
not blocked2
No public exploit2
20150
20160
20171
Not applicable1
Medium1
not blocked1
No public exploit1
20181
No exploit published1
Medium1
not blocked1
No public exploit1
20193
Not applicable3
Medium3
not blocked3
No public exploit3
20207
Protected by Waratek2
No exploit published2
Not applicable3
Medium7
blocked by ARMR today2
not blocked5
No public exploit7
20211
Not applicable1
Medium1
not blocked1
No public exploit1
20224
Not applicable4
Medium4
not blocked4
No public exploit4
20235
Not applicable5
Medium5
not blocked5
Proof of concept only3
No public exploit2
20244
Not applicable4
Medium4
not blocked4
No public exploit4
20253
Not applicable3
Medium3
not blocked3
No public exploit3
20263
No exploit published1
Not applicable2
Medium3
not blocked3
No public exploit3
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-22054 | Medium | 2026-06-03 | Not applicable | No public exploit | Active IQ Config Advisor version 6.7.3 contains hard-coded credentials that could allow an authenticated attacker with low privileges to perform unauthorized AutoSupport operations. |
| CVE-2026-40966 | Medium | 2026-04-28 | No exploit published | No public exploit | In Spring AI, an attacker can bypass conversation isolation and exfiltrate sensitive memory from other users’ chat histories, including secrets and credentials, by injecting filter logic through conversationId. Only applications that use VectorStoreChatMemoryAdvisor and pass user-supplied input as a conversationId are affected. |
| CVE-2025-46699 | Medium | 2026-01-23 | Not applicable | No public exploit | Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability in the Server. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure. |
| CVE-2025-20079 | Medium | 2025-05-13 | Not applicable | No public exploit | Uncontrolled search path for some Intel(R) Advisor software may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2024-49822 | Medium | 2025-03-18 | Not applicable | No public exploit | IBM QRadar Advisor 1.0.0 through 2.6.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. |
| CVE-2024-39284 | Medium | 2025-02-12 | Not applicable | No public exploit | Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2024-26025 | Medium | 2024-08-14 | Not applicable | No public exploit | Incorrect default permissions for some Intel(R) Advisor software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2024-38446 | Medium | 2024-07-17 | Not applicable | No public exploit | NATO NCI ANET 3.4.1 mishandles report ownership. A user can create a report and, despite the restrictions imposed by the UI, change the author of that report to an arbitrary user (without their consent or knowledge) via a modified UUID in a POST request. |
| CVE-2023-29162 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2023-6037 | Medium | 2024-01-01 | Not applicable | No public exploit | The WP TripAdvisor Review Slider WordPress plugin before 11.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) |
| CVE-2023-27383 | Medium | 2023-11-14 | Not applicable | No public exploit | Protection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version 2021.9 may allow a privileged user to potentially enable escalation of privilege via adjacent access. |
| CVE-2022-48566 | Medium | 2023-08-22 | Not applicable | Proof of concept only | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. |
| CVE-2023-27391 | Medium | 2023-08-11 | Not applicable | No public exploit | Improper access control in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2023-31441 | Medium | 2023-07-18 | Not applicable | Proof of concept only | In NATO Communications and Information Agency anet (aka Advisor Network) through 3.3.0, an attacker can provide a crafted JSON file to sanitizeJson and cause an exception. This is related to the U+FFFD Unicode replacement character. A for loop does not consider that a data structure is being modified during loop execution. |
| CVE-2023-1767 | Medium | 2023-04-20 | Not applicable | Proof of concept only | The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. A feature of Snyk Advisor is to display the contents of a scanned package's Readme on its package health page. An attacker could create a package in NPM with an associated markdown README file containing XSS-able HTML tags. Upon Snyk Advisor importing the package, the XSS would run each time an end user browsed to the package's page on Snyk Advisor. |
| CVE-2022-41299 | Medium | 2022-12-09 | Not applicable | No public exploit | IBM Cloud Transformation Advisor 2.0.1 through 3.3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 237214. |
| CVE-2022-41553 | Medium | 2022-11-01 | Not applicable | No public exploit | Insertion of Sensitive Information into Temporary File vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Hitachi Ops Center Analyzer probe component) allows local users to gain sensitive information. This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00. |
| CVE-2020-36605 | Medium | 2022-11-01 | Not applicable | No public exploit | Incorrect Default Permissions vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component), Hitachi Ops Center Viewpoint on Linux (Viewpoint RAID Agent component) allows local users to read and write specific files. This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.0-00; Hitachi Ops Center Viewpoint: from 10.8.0-00 before 10.9.0-00. |
| CVE-2022-33935 | Medium | 2022-08-30 | Not applicable | No public exploit | Dell EMC Data Protection Advisor versions 19.6 and earlier, contains a Stored Cross Site Scripting, an attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery. |
| CVE-2021-38896 | Medium | 2021-10-20 | Not applicable | No public exploit | IBM QRadar Advisor 2.5 through 2.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 209566. |
| CVE-2020-2258 | Medium | 2020-09-16 | No exploit published | No public exploit | Jenkins Health Advisor by CloudBees Plugin 3.2.0 and earlier does not correctly perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to view that HTTP endpoint. |
| CVE-2020-4408 | Medium | 2020-07-27 | Not applicable | No public exploit | The IBM QRadar Advisor 1.1 through 2.5.2 with Watson App for IBM QRadar SIEM does not adequately mask all passwords during input, which could be obtained by a physical attacker nearby. IBM X-Force ID: 179536. |
| CVE-2019-14900 | Medium | 2020-07-06 | Protected by Waratek | No public exploit | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. |
| CVE-2011-2487 | Medium | 2020-03-11 | Protected by Waratek | No public exploit | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack. |
| CVE-2019-4672 | Medium | 2020-02-25 | Not applicable | No public exploit | IBM QRadar Advisor 1.1 through 2.5 could allow an unauthorized attacker to obtain sensitive information from specially crafted HTTP requests that could aid in further attacks against the system. IBM X-Force ID: 171438. |
| CVE-2018-21033 | Medium | 2020-02-14 | Not applicable | No public exploit | A vulnerability in Hitachi Command Suite prior to 8.6.2-00, Hitachi Automation Director prior to 8.6.2-00 and Hitachi Infrastructure Analytics Advisor prior to 4.2.0-00 allow authenticated remote users to load an arbitrary Cascading Style Sheets (CSS) token sequence. Hitachi Command Suite includes Hitachi Device Manager, Hitachi Tiered Storage Manager, Hitachi Replication Manager, Hitachi Tuning Manager, Hitachi Global Link Manager and Hitachi Compute Systems Manager. |
| CVE-2020-2094 | Medium | 2020-01-15 | No exploit published | No public exploit | A missing permission check in Jenkins Health Advisor by CloudBees Plugin 3.0 and earlier allows attackers with Overall/Read permission to send a fixed email to an attacker-specific recipient. |
| CVE-2019-3666 | Medium | 2019-12-03 | Not applicable | No public exploit | API Abuse/Misuse vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to navigate to restricted websites via a carefully crafted web site. |
| CVE-2019-3665 | Medium | 2019-12-03 | Not applicable | No public exploit | Code Injection vulnerability in the web interface in McAfee Web Advisor (WA) prior to 4.1.1.48 allows remote unauthenticated attacker to allow the browser to render a website which Web Advisor would normally have blocked via a carefully crafted web site. |
| CVE-2019-4556 | Medium | 2019-11-09 | Not applicable | No public exploit | IBM QRadar Advisor 1.0.0 through 2.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 166205. |
| CVE-2018-1288 | Medium | 2018-07-26 | No exploit published | No public exploit | In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request interfering with data replication, resulting in data loss. |
| CVE-2017-8003 | Medium | 2017-07-09 | Not applicable | No public exploit | EMC Data Protection Advisor prior to 6.4 contains a path traversal vulnerability. A remote authenticated high privileged user may potentially exploit this vulnerability to access unauthorized information from the underlying OS server by supplying specially crafted strings in input parameters of the application. |
| CVE-2014-7465 | Medium | 2014-10-19 | Not applicable | No public exploit | The PC Advisor (aka com.triactivemedia.pcadvisor) application @7F08017A for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2014-6866 | Medium | 2014-10-02 | Not applicable | No public exploit | The HomeAdvisor Mobile (aka com.servicemagic.consumer) application 3.0.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2012-4917 | Medium | 2013-01-26 | Not applicable | No public exploit | The TripAdvisor app 6.6 for iOS sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network. |
| CVE-2012-4616 | Medium | 2012-12-26 | Not applicable | No public exploit | Directory traversal vulnerability in the Web UI in EMC Data Protection Advisor (DPA) 5.6 through SP1, 5.7 through SP1, and 5.8 through SP4 allows remote attackers to read arbitrary files via unspecified vectors. |
| CVE-2012-0407 | Medium | 2012-04-20 | Not applicable | Working exploit published | Integer overflow in the DPA_Utilities library in EMC Data Protection Advisor (DPA) 5.5 through 5.8 SP1 allows remote attackers to cause a denial of service (infinite loop) via a negative 64-bit value in a certain size field. |
| CVE-2000-0927 | Medium | 2000-12-19 | Not applicable | No public exploit | WQuinn QuotaAdvisor 4.1 does not properly record file sizes if they are stored in alternative data streams, which allows users to bypass quota restrictions. |