WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product blockchain platform✕
Overview 10 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
10matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC20.0% 2EPSS ≥ 0.520.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 10 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 7 70.0% Medium 3 30.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 10 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 10.0% Proof of concept only 1 10.0% Forecast only 0 0.0% No public exploit 8 80.0%
split by peak 3 / quarter
Not applicable: 10 Medium: 3High: 7 not blocked: 10 No public exploit: 8Proof of concept only: 1Working exploit published: 1
Q3 171 Not applicable1 Medium1 not blocked1 No public exploit1 Q4 171 Not applicable1 High1 not blocked1 No public exploit1 Q1 180 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 192 Not applicable2 High1 Medium1 not blocked2 No public exploit2 Q4 190 Q1 200 Q2 201 Not applicable1 High1 not blocked1 No public exploit1 Q3 203 Not applicable3 High2 Medium1 not blocked3 No public exploit3 Q4 201 Not applicable1 High1 not blocked1 Proof of concept only1 Q1 210 Q2 211 Not applicable1 High1 not blocked1 Working exploit published1
Q4 17Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-23017 High 2021-06-01 Not applicable Working exploit published A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact.
CVE-2020-8277 High 2020-11-19 Not applicable Proof of concept only A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. This is fixed in 15.2.1, 14.15.1, and 12.19.1.
CVE-2020-8174 High 2020-07-24 Not applicable No public exploit napi_get_value_string_*() allows various kinds of memory corruption in node < 10.21.0, 12.18.0, and < 14.4.0.
CVE-2020-8203 High 2020-07-15 Not applicable No public exploit Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
CVE-2020-15719 Medium 2020-07-14 Not applicable No public exploit libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.
CVE-2020-8172 High 2020-06-08 Not applicable No public exploit TLS session reuse can lead to host certificate verification bypass in node version < 12.18.0 and < 14.4.0.
CVE-2019-13565 High 2019-07-26 Not applicable No public exploit An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user.
CVE-2019-13057 Medium 2019-07-26 Not applicable No public exploit An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a proxyAuthz (RFC 4370) control. (It is not a common configuration to deploy a system where the server administrator and a DB administrator enjoy different levels of trust.)
CVE-2017-17740 High 2017-12-18 Not applicable No public exploit contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.
CVE-2017-14159 Medium 2017-09-05 Not applicable No public exploit slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript.