WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product base✕
Overview 6 matches · 0 protected · 3 exploited · 0 CISA KEV · 4 public PoC · 1 EPSS ≥ 0.5
6matches 0protected0.0% 3exploited50.0% 0CISA KEV0.0% 4public PoC66.7% 1EPSS ≥ 0.516.7%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 6 100.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 3 50.0% High 3 50.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 6 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 50.0% Working exploit published 1 16.7% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 1 16.7%
split by peak 4 / quarter
Mitigation candidate: 6 High: 3Critical: 3 not blocked: 6 No public exploit: 1Proof of concept only: 1Working exploit published: 1Exploited: 3
Q1 204 Mitigation candidate4 Critical3 High1 not blocked4 Exploited2 Proof of concept only1 No public exploit1 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 220 Q4 220 Q1 230 Q2 231 Mitigation candidate1 High1 not blocked1 Working exploit published1 Q3 231 Mitigation candidate1 High1 not blocked1 Exploited1
Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-36542 High 2023-07-29 Mitigation candidate Exploited Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which allows an authenticated and authorized user to configure a location that enables custom code execution. The resolution introduces a new Required Permission for referencing remote resources, restricting configuration of these components to privileged users. The permission prevents unprivileged users from configuring Processors and Controller Services annotated with the new Reference Remote Resources restriction. Upgrading to Apache NiFi 1.23.0 is the recommended mitigation.
CVE-2023-34468 High 2023-06-12 Mitigation candidate Working exploit published The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. The resolution validates the Database URL and rejects H2 JDBC locations. You are recommended to upgrade to version 1.22.0 or later which fixes this issue.
CVE-2020-10673 High 2020-03-18 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).
CVE-2020-9548 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
CVE-2020-9547 Critical 2020-03-02 Mitigation candidate Exploited FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
CVE-2020-9546 Critical 2020-03-02 Mitigation candidate No public exploit FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).