WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product cloud connect✕
Overview 11 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
11matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 11 100.0% Withdrawn CVE 0 0.0%
Critical 3 27.3% High 5 45.5% Medium 2 18.2% Low 1 9.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 9.1% Forecast only 0 0.0% No public exploit 10 90.9%
split by peak 5 / year
Not applicable: 11 Low: 1Medium: 2High: 5Critical: 3 not blocked: 11 No public exploit: 10Proof of concept only: 1
20192 Not applicable2 Critical2 not blocked2 No public exploit2 20200 20215 Not applicable5 Critical1 High2 Medium2 not blocked5 No public exploit5 20220 20232 Not applicable2 High1 Low1 not blocked2 No public exploit2 20241 Not applicable1 High1 not blocked1 Proof of concept only1 20250 20261 Not applicable1 High1 not blocked1 No public exploit1
20192020202120222023202420252026
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-45170 High 2026-06-12 Not applicable No public exploit Idira Vendor PAM - Self-Hosted Connector versions prior 1.1.100504 under specific conditions and configuration scenarios, TLS certificate validation may not be fully enforced. CyberArk Security Bulletin: CA26-17
CVE-2024-25642 High 2024-02-13 Not applicable Proof of concept only Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication. Hence, the attacker can intercept the request to view/modify sensitive information. There is no impact on the availability of the system.
CVE-2023-49578 Low 2023-12-12 Not applicable No public exploit SAP Cloud Connector - version 2.0, allows an authenticated user with low privilege to perform Denial of service attack from adjacent UI by sending a malicious request which leads to low impact on the availability and no impact on confidentiality or Integrity  of the application.
CVE-2023-28831 High 2023-09-12 Not applicable No public exploit The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application to run into an infinite loop during certificate validation. This could allow an unauthenticated remote attacker to create a denial of service condition by sending a specially crafted certificate.
CVE-2021-33695 Critical 2021-09-15 Not applicable No public exploit Potentially, SAP Cloud Connector, version - 2.0 communication with the backend is accepted without sufficient validation of the certificate.
CVE-2021-33694 Medium 2021-09-15 Not applicable No public exploit SAP Cloud Connector, version - 2.0, does not sufficiently encode user-controlled inputs, allowing an attacker with Administrator rights, to include malicious codes that get stored in the database, and when accessed, could be executed in the application, resulting in Stored Cross-Site Scripting.
CVE-2021-33693 Medium 2021-09-15 Not applicable No public exploit SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead to OS command execution.
CVE-2021-33692 High 2021-09-15 Not applicable No public exploit SAP Cloud Connector, version - 2.0, allows the upload of zip files as backup. This backup file can be tricked to inject special elements such as '..' and '/' separators, for attackers to escape outside of the restricted location to access files or directories.
CVE-2021-22914 High 2021-06-16 Not applicable No public exploit Citrix Cloud Connector before 6.31.0.62192 suffers from insecure storage of sensitive information due to sensitive information being stored in the Citrix Cloud Connector installation log files. Such information could be used by an malicious actor to access a Citrix Cloud environment. This issue affects all versions of Citrix Cloud Connector that were installed by passing secure client parameters for installation via the command line. The issue does not affect Citrix Cloud Connector if it was installed using the interactive installer or where a parameter file was used with the command-line installer.
CVE-2019-0247 Critical 2019-01-08 Not applicable No public exploit SAP Cloud Connector, before version 2.11.3, allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVE-2019-0246 Critical 2019-01-08 Not applicable No public exploit SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity.