Overview 14 matches · 6 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
14matches
6in Waratek scope42.9%
1protected7.1%
0exploited0.0%
0CISA KEV0.0%
3public PoC21.4%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
7.1%
Rule in development
0
0.0%
Mitigation candidate
2
14.3%
No exploit published
3
21.4%
Outside Waratek scope
0
0.0%
Not applicable
8
57.1%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
7.1%
partly blocked
0
0.0%
not blocked
13
92.9%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
3
21.4%
Proof of concept only
2
14.3%
Forecast only
0
0.0%
No public exploit
9
64.3%
split by
peak 5 / year
20195
Protected by Waratek1
Mitigation candidate2
Not applicable2
Medium5
blocked by ARMR today1
not blocked4
Working exploit published3
No public exploit2
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20210
20220
20233
No exploit published1
Not applicable2
Medium3
not blocked3
Proof of concept only1
No public exploit2
20244
No exploit published1
Not applicable3
Medium4
not blocked4
Proof of concept only1
No public exploit3
20250
20261
No exploit published1
Medium1
not blocked1
No public exploit1
20192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-32781 | Medium | 2026-07-15 | No exploit published | No public exploit | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verify application and namespace permissions when an authenticated user requests a release by ID through GET /envs/{env}/releases/{releaseId} while configView.memberOnly.envs is enabled, allowing a low-privileged Portal user who obtains or guesses a valid releaseId to read configuration data from other applications and namespaces without calling UserPermissionValidator.shouldHideConfigToCurrentUser(...). This issue is fixed in version 2.5.0. |
| CVE-2024-43397 | Medium | 2024-08-20 | No exploit published | No public exploit | Apollo is a configuration management system. A vulnerability exists in the synchronization configuration feature that allows users to craft specific requests to bypass permission checks. This exploit enables them to modify a namespace without the necessary permissions. The issue was addressed with an input parameter check which was released in version 2.3.0. |
| CVE-2024-37480 | Medium | 2024-07-21 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions apollo13-framework-extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.3. |
| CVE-2024-24880 | Medium | 2024-02-08 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apollo13Themes Apollo13 Framework Extensions allows Stored XSS.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.2. |
| CVE-2022-4962 | Medium | 2024-01-12 | Not applicable | Proof of concept only | A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive. |
| CVE-2023-47190 | Medium | 2023-11-08 | Not applicable | Proof of concept only | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin <= 1.9.0 versions. |
| CVE-2023-30959 | Medium | 2023-09-27 | Not applicable | No public exploit | In Apollo change requests, comments added by users could contain a javascript URI link that when rendered will result in an XSS that require user interaction. |
| CVE-2023-25569 | Medium | 2023-02-20 | No exploit published | No public exploit | Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticated portal admin visits this page, the page can silently send a request to assign new roles for that user without any confirmation from the Portal admin. Cookie SameSite strategy was set to Lax in version 2.1.0. As a workaround, avoid visiting unknown source pages. |
| CVE-2020-7207 | Medium | 2020-11-05 | Not applicable | No public exploit | A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board. |
| CVE-2019-11136 | Medium | 2019-11-14 | Not applicable | No public exploit | Insufficient access control in system firmware for Intel(R) Xeon(R) Scalable Processors, 2nd Generation Intel(R) Xeon(R) Scalable Processors and Intel(R) Xeon(R) Processors D Family may allow a privileged user to potentially enable escalation of privilege, denial of service and/or information disclosure via local access. |
| CVE-2019-11135 | Medium | 2019-11-14 | Not applicable | No public exploit | TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access. |
| CVE-2019-13237 | Medium | 2019-08-27 | Protected by Waratek | Working exploit published | In Alkacon OpenCms 10.5.4 and 10.5.5, there are multiple resources vulnerable to Local File Inclusion that allow an attacker to access server resources: clearhistory.jsp, convertxml.jsp, group_new.jsp, loginmessage.jsp, xmlcontentrepair.jsp, and /system/workplace/admin/history/settings/index.jsp. |
| CVE-2019-13235 | Medium | 2019-08-27 | Mitigation candidate | Working exploit published | In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the Login form. |
| CVE-2019-13234 | Medium | 2019-08-27 | Mitigation candidate | Working exploit published | In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5, there is XSS in the search engine. |