WaratekVRT Sign in
Reset
More filters (1)
Columns
Product commerce✕
Overview 8 matches · 1 exploited · 1 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
8matches 1exploited12.5% 1CISA KEV12.5% 2public PoC25.0% 1EPSS ≥ 0.512.5%
Protected by Waratek 8 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 8 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 8 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 12.5% Working exploit published 0 0.0% Proof of concept only 1 12.5% Forecast only 0 0.0% No public exploit 6 75.0%
split by peak 1 / quarter
Protected by Waratek: 8 High: 8 blocked by ARMR today: 8 No public exploit: 6Proof of concept only: 1Exploited: 1
Q2 181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q3 180 Q4 180 Q1 190 Q2 190 Q3 190 Q4 190 Q1 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q2 200 Q3 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q1 211 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 Q2 211 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q3 211 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q4 211 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-37136 High 2021-10-19 Protected by Waratek No public exploit The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
CVE-2021-39144 High 2021-08-23 Protected by Waratek Exploited XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker has sufficient rights to execute commands of the host only by manipulating the processed input stream. No user is affected, who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default, since it cannot be secured for general purpose.
CVE-2021-22118 High 2021-05-27 Protected by Waratek No public exploit In Spring Framework, versions 5.2.x prior to 5.2.15 and versions 5.3.x prior to 5.3.7, a WebFlux application is vulnerable to a privilege escalation: by (re)creating the temporary storage directory, a locally authenticated malicious user can read or modify files that have been uploaded to the WebFlux application, or overwrite arbitrary files with multipart request data.
CVE-2020-36188 High 2021-01-06 Protected by Waratek Proof of concept only FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource.
CVE-2020-25649 High 2020-12-03 Protected by Waratek No public exploit A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVE-2020-7712 High 2020-08-30 Protected by Waratek No public exploit This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
CVE-2020-2604 High 2020-01-15 Protected by Waratek No public exploit Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and 13.0.1; Java SE Embedded: 8u231. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in takeover of Java SE, Java SE Embedded. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS v3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2018-1272 High 2018-04-06 Protected by Waratek No public exploit Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, provide client-side support for multipart requests. When Spring MVC or Spring WebFlux server application (server A) receives input from a remote client, and then uses that input to make a multipart request to another server (server B), it can be exposed to an attack, where an extra multipart is inserted in the content of the request from server A, causing server B to use the wrong value for a part it expects. This could to lead privilege escalation, for example, if the part content represents a username or user roles.