Overview 4 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
4
100.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
blocked by ARMR today
4
100.0%
partly blocked
0
0.0%
not blocked
0
0.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
1
25.0%
Forecast only
0
0.0%
No public exploit
3
75.0%
split by
peak 1 / month
Aug 191
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Sep 190
Oct 190
Nov 190
Dec 190
Jan 200
Feb 200
Mar 200
Apr 200
May 200
Jun 201
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Jul 200
Aug 200
Sep 200
Oct 200
Nov 200
Dec 201
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Jan 211
Protected by Waratek1
High1
blocked by ARMR today1
Proof of concept only1
Sep 19Nov 19Jan 20Mar 20May 20Jul 20Sep 20Nov 20Jan 21
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2020-36188 | High | 2021-01-06 | Protected by Waratek | Proof of concept only | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.JNDIConnectionSource. |
| CVE-2020-25649 | High | 2020-12-03 | Protected by Waratek | No public exploit | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity. |
| CVE-2020-14195 | High | 2020-06-16 | Protected by Waratek | No public exploit | FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity). |
| CVE-2019-10086 | High | 2019-08-20 | Protected by Waratek | No public exploit | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. |