WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product cloud manager✕
Overview 7 matches · 3 in Waratek scope · 3 protected · 2 exploited · 2 CISA KEV · 2 public PoC · 3 EPSS ≥ 0.5
7matches 3in Waratek scope42.9% 3protected42.9% 2exploited28.6% 2CISA KEV28.6% 2public PoC28.6% 3EPSS ≥ 0.542.9%
Protected by Waratek 3 42.9% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 14.3% Not applicable 3 42.9% Withdrawn CVE 0 0.0%
Critical 7 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 42.9% partly blocked 0 0.0% not blocked 4 57.1% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 28.6% Working exploit published 0 0.0% Proof of concept only 1 14.3% Forecast only 0 0.0% No public exploit 4 57.1%
split by peak 2 / year
Not applicable: 3Outside Waratek scope: 1Protected by Waratek: 3 Critical: 7 not blocked: 4blocked by ARMR today: 3 No public exploit: 4Proof of concept only: 1Exploited: 2
20161 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20170 20180 20190 20201 Not applicable1 Critical1 not blocked1 No public exploit1 20212 Protected by Waratek1 Outside Waratek scope1 Critical2 blocked by ARMR today1 not blocked1 Exploited1 No public exploit1 20221 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1 20232 Not applicable2 Critical2 not blocked2 No public exploit2
20162017201820192020202120222023
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-41748 Critical 2023-08-31 Not applicable No public exploit Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.
CVE-2023-41746 Critical 2023-08-31 Not applicable No public exploit Remote command execution due to improper input validation. The following products are affected: Acronis Cloud Manager (Windows) before build 6.2.23089.203.
CVE-2022-23305 Critical 2022-01-18 Protected by Waratek Proof of concept only By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-44228 Critical 2021-12-10 Protected by Waratek Exploited Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2021-26990 Critical 2021-03-19 Outside Waratek scope No public exploit Cloud Manager versions prior to 3.9.4 are susceptible to a vulnerability that could allow a remote attacker to overwrite arbitrary system files.
CVE-2019-17275 Critical 2020-02-26 Not applicable No public exploit OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
CVE-2016-3427 Critical 2016-04-21 Protected by Waratek Exploited Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.