WaratekVRT Sign in
Reset
More filters (1)
Columns
Product database✕
Overview 6 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
6matches 0exploited0.0% 0CISA KEV0.0% 1public PoC16.7% 1EPSS ≥ 0.516.7%
Protected by Waratek 6 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 6 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 6 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 16.7% Proof of concept only 1 16.7% Forecast only 0 0.0% No public exploit 4 66.7%
split by peak 2 / year
Protected by Waratek: 6 Critical: 6 blocked by ARMR today: 6 No public exploit: 4Proof of concept only: 1Working exploit published: 1
20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 20181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20192 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 20200 20210 20221 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20231 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1
2017201820192020202120222023
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-41887 Critical 2023-09-15 Protected by Waratek Proof of concept only OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue.
CVE-2022-41853 Critical 2022-10-06 Protected by Waratek No public exploit Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to call any static method of any Java class in the classpath resulting in code execution. The issue can be prevented by updating to 2.7.1 or by setting the system property "hsqldb.method_class_names" to classes which are allowed to be called. For example, System.setProperty("hsqldb.method_class_names", "abc") or Java argument -Dhsqldb.method_class_names="abc" can be used. From version 2.7.1 all classes by default are not accessible except those in java.lang.Math and need to be manually enabled.
CVE-2018-14719 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVE-2018-14718 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2017-15095 Critical 2018-02-06 Protected by Waratek No public exploit A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.