WaratekVRT Sign in
Reset
More filters (1)
Columns
Product advisor✕
Overview 5 matches · 3 protected · 2 exploited · 2 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
5matches 3protected60.0% 2exploited40.0% 2CISA KEV40.0% 3public PoC60.0% 2EPSS ≥ 0.540.0%
Protected by Waratek 5 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 5 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 60.0% partly blocked 2 40.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 40.0% Working exploit published 0 0.0% Proof of concept only 2 40.0% Forecast only 0 0.0% No public exploit 1 20.0%
split by peak 2 / year
Protected by Waratek: 5 High: 5 partly blocked: 2blocked by ARMR today: 3 No public exploit: 1Proof of concept only: 2Exploited: 2
20172 Protected by Waratek2 High2 partly blocked2 Exploited2 20180 20191 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 20200 20210 20220 20231 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20241 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1
20172018201920202021202220232024
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-1132 High 2024-04-17 Protected by Waratek Proof of concept only A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.
CVE-2022-1415 High 2023-09-11 Protected by Waratek No public exploit A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server.
CVE-2019-14439 High 2019-07-30 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2017-12617 High 2017-10-04 Protected by Waratek Exploited When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2017-12615 High 2017-09-19 Protected by Waratek Exploited When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.