Medium Communications Network Integrity CVEs
8 CVEs, 1 exploited, 4 protected by Waratek
Overview 8 matches · 4 protected · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
Protected by Waratek
4
50.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
4
50.0%
blocked by ARMR today
4
50.0%
partly blocked
0
0.0%
not blocked
4
50.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
12.5%
Working exploit published
1
12.5%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
6
75.0%
split by
peak 2 / quarter
Q2 181
No exploit published1
Medium1
not blocked1
No public exploit1
Q3 181
No exploit published1
Medium1
not blocked1
No public exploit1
Q4 180
Q1 190
Q2 190
Q3 192
No exploit published2
Medium2
not blocked2
No public exploit2
Q4 192
Protected by Waratek2
Medium2
blocked by ARMR today2
No public exploit2
Q1 200
Q2 200
Q3 200
Q4 200
Q1 210
Q2 211
Protected by Waratek1
Medium1
blocked by ARMR today1
Working exploit published1
Q3 210
Q4 211
Protected by Waratek1
Medium1
blocked by ARMR today1
Exploited1
Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2021-45105 | Medium | 2021-12-18 | Protected by Waratek | Exploited | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1. |
| CVE-2020-6950 | Medium | 2021-06-02 | Protected by Waratek | Working exploit published | Directory traversal in Eclipse Mojarra before 2.3.14 allows attackers to read arbitrary files via the loc parameter or con parameter. |
| CVE-2019-10219 | Medium | 2019-11-08 | Protected by Waratek | No public exploit | A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. |
| CVE-2019-17091 | Medium | 2019-10-02 | Protected by Waratek | No public exploit | faces/context/PartialViewContextImpl.java in Eclipse Mojarra, as used in Mojarra for Eclipse EE4J before 2.3.10 and Mojarra JavaServer Faces before 2.2.20, allows Reflected XSS because a client window field is mishandled. |
| CVE-2019-3739 | Medium | 2019-09-18 | No exploit published | No public exploit | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys. |
| CVE-2019-3738 | Medium | 2019-09-18 | No exploit published | No public exploit | RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key. |
| CVE-2018-8032 | Medium | 2018-08-02 | No exploit published | No public exploit | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services. |
| CVE-2018-11039 | Medium | 2018-06-25 | No exploit published | No public exploit | Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior to 4.3.18, and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability, a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack. |