WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product beam✕
Overview 12 matches · 4 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
12matches 4in Waratek scope33.3% 1protected8.3% 0exploited0.0% 0CISA KEV0.0% 3public PoC25.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 8.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 25.0% Outside Waratek scope 0 0.0% Not applicable 8 66.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 12 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 8.3% partly blocked 0 0.0% not blocked 11 91.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 3 25.0% Proof of concept only 1 8.3% Forecast only 0 0.0% No public exploit 8 66.7%
split by peak 2 / year
Not applicable: 8No exploit published: 3Protected by Waratek: 1 High: 12 not blocked: 11blocked by ARMR today: 1 No public exploit: 8Proof of concept only: 1Working exploit published: 3
20061 Not applicable1 High1 not blocked1 Working exploit published1 20070 20081 Not applicable1 High1 not blocked1 Working exploit published1 20091 Not applicable1 High1 not blocked1 Working exploit published1 20100 20110 20120 20130 20140 20150 20160 20171 Not applicable1 High1 not blocked1 No public exploit1 20181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20190 20202 No exploit published2 High2 not blocked2 No public exploit2 20212 Not applicable2 High2 not blocked2 No public exploit2 20222 No exploit published1 Not applicable1 High2 not blocked2 Proof of concept only1 No public exploit1 20231 Not applicable1 High1 not blocked1 No public exploit1
200720092011201320152017201920212023
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-4296 High 2023-08-29 Not applicable No public exploit ​If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the target device.
CVE-2022-23496 High 2022-12-08 No exploit published No public exploit Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. If uncaught the exception will result in a program crash. Applications that do not use this feature are not affected. Users are advised to upgrade to version 7.9.0. Users unable to upgrade may catch and discard any ArrayIndexOutOfBoundsException thrown by the Yauaa library.
CVE-2022-23639 High 2022-02-15 Not applicable Proof of concept only crossbeam-utils provides atomics, synchronization primitives, scoped threads, and other utilities for concurrent programming in Rust. crossbeam-utils prior to version 0.8.7 incorrectly assumed that the alignment of `{i,u}64` was always the same as `Atomic{I,U}64`. However, the alignment of `{i,u}64` on a 32-bit target can be smaller than `Atomic{I,U}64`. This can cause unaligned memory accesses and data race. Crates using `fetch_*` methods with `AtomicCell<{i,u}64>` are affected by this issue. 32-bit targets without `Atomic{I,U}64` and 64-bit targets are not affected by this issue. This has been fixed in crossbeam-utils 0.8.7. There are currently no known workarounds.
CVE-2020-26516 High 2021-06-08 Not applicable No public exploit A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. Requests sent to the server that trigger actions do not contain a CSRF token and can therefore be entirely predicted allowing attackers to cause the victim's browser to execute undesired actions in the web application through crafted requests.
CVE-2020-26515 High 2021-06-08 Not applicable No public exploit An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The remember-me cookie (CB_LOGIN) issued by the application contains the encrypted user's credentials. However, due to a bug in the application code, those credentials are encrypted using a NULL encryption key.
CVE-2020-27216 High 2020-10-23 No exploit published No public exploit In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. If the attacker wins the race then they will have read and write permission to the subdirectory used to unpack web applications, including their WEB-INF/lib jar files and JSP files. If any code is ever executed out of this temporary directory, this can lead to a local privilege escalation vulnerability.
CVE-2020-1929 High 2020-01-15 No exploit published No public exploit The Apache Beam MongoDB connector in versions 2.10.0 to 2.16.0 has an option to disable SSL trust verification. However this configuration is not respected and the certificate verification disables trust verification in every case. This exclusion also gets registered globally which disables trust checking for any code running in the same JVM.
CVE-2018-1259 High 2018-05-11 Protected by Waratek No public exploit Spring Data Commons, versions 1.13 prior to 1.13.12 and 2.0 prior to 2.0.7, used in combination with XMLBeam 1.4.14 or earlier versions, contains a property binder vulnerability caused by improper restriction of XML external entity references as underlying library XMLBeam does not restrict external reference expansion. An unauthenticated remote malicious user can supply specially crafted request parameters against Spring Data's projection-based request payload binding to access arbitrary files on the system.
CVE-2017-17763 High 2017-12-19 Not applicable No public exploit SuperBeam through 4.1.3, when using the LAN or WiFi Direct Share feature, does not use HTTPS or any integrity-protection mechanism for file transfer, which makes it easier for remote attackers to send crafted files, as demonstrated by APK injection.
CVE-2009-0377 High 2009-02-02 Not applicable Working exploit published SQL injection vulnerability in the beamospetition (com_beamospetition) 1.0.12 component for Joomla! allows remote attackers to execute arbitrary SQL commands via the mpid parameter in a sign action to index.php, a different vector than CVE-2008-3132.
CVE-2008-3132 High 2008-07-10 Not applicable Working exploit published SQL injection vulnerability in the beamospetition (com_beamospetition) component for Joomla! allows remote attackers to execute arbitrary SQL commands via the pet parameter to index.php.
CVE-2006-0359 High 2006-01-22 Not applicable Working exploit published Buffer overflow in CounterPath eyeBeam SIP Softphone allows remote attackers to (1) cause a denial of service (device crash) via SIP INVITE commands with a long header field name sent during startup and (2) cause a denial of service (device hang or crash) via SIP INVITE commands with a long header field name sent during a call.