WaratekVRT Sign in
Reset
More filters (1)
Columns
Product communications messaging server✕
Overview 3 matches · 1 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
3matches 1exploited33.3% 0CISA KEV0.0% 1public PoC33.3% 1EPSS ≥ 0.533.3%
Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 3 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 33.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 66.7%
split by peak 1 / quarter
Protected by Waratek: 3 Medium: 3 blocked by ARMR today: 3 No public exploit: 2Exploited: 1
Q4 191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q1 200 Q2 200 Q3 200 Q4 200 Q1 211 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q2 210 Q3 210 Q4 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1
Q4 19Q1 20Q2 20Q3 20Q4 20Q1 21Q2 21Q3 21Q4 21
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-45105 Medium 2021-12-18 Protected by Waratek Exploited Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2021-21290 Medium 2021-02-08 Protected by Waratek No public exploit Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.
CVE-2019-10219 Medium 2019-11-08 Protected by Waratek No public exploit A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.