WaratekVRT Sign in
Reset
More filters (1)
Columns
Product application testing suite✕
Overview 4 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
4matches 0exploited0.0% 0CISA KEV0.0% 1public PoC25.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 4 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 4 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 25.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 1 / quarter
Protected by Waratek: 4 High: 4 blocked by ARMR today: 4 No public exploit: 3Proof of concept only: 1
Q2 181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q3 180 Q4 180 Q1 190 Q2 190 Q3 191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 190 Q1 200 Q2 200 Q3 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 200 Q1 211 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1
Q2 18Q3 18Q4 18Q1 19Q2 19Q3 19Q4 19Q1 20Q2 20Q3 20Q4 20Q1 21
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-36188 High 2021-01-06 Protected by Waratek Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVE-2020-24750 High 2020-09-17 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.10.6 mishandles the interaction between serialization gadgets and typing, related to com.pastdev.httpcomponents.configuration.JndiConfiguration.
CVE-2019-10086 High 2019-08-20 Protected by Waratek No public exploit In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVE-2018-1272 High 2018-04-06 Protected by Waratek No public exploit Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.