WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product deploy✕
Overview 16 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
16matches 2in Waratek scope12.5% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 12.5% Outside Waratek scope 1 6.2% Not applicable 13 81.2% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 16 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 16 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 3 18.8% Forecast only 0 0.0% No public exploit 13 81.2%
split by peak 3 / year
Not applicable: 13Outside Waratek scope: 1No exploit published: 2 Low: 16 not blocked: 16 No public exploit: 13Proof of concept only: 3
20041 Not applicable1 Low1 not blocked1 No public exploit1 20050 20060 20070 20082 Not applicable2 Low2 not blocked2 No public exploit2 20090 20100 20111 Not applicable1 Low1 not blocked1 No public exploit1 20120 20131 Not applicable1 Low1 not blocked1 No public exploit1 20140 20152 Not applicable2 Low2 not blocked2 No public exploit2 20160 20170 20180 20190 20202 Not applicable2 Low2 not blocked2 No public exploit2 20211 No exploit published1 Low1 not blocked1 No public exploit1 20220 20230 20243 No exploit published1 Not applicable2 Low3 not blocked3 Proof of concept only1 No public exploit2 20253 Outside Waratek scope1 Not applicable2 Low3 not blocked3 Proof of concept only2 No public exploit1
20052007200920112013201520172019202120232025
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-1181 Low 2025-02-11 Outside Waratek scope Proof of concept only A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue.
CVE-2025-0167 Low 2025-02-05 Not applicable Proof of concept only When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.
CVE-2024-51472 Low 2025-01-06 Not applicable No public exploit IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.
CVE-2024-11053 Low 2024-12-11 Not applicable Proof of concept only When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has an entry that matches the redirect target hostname but the entry either omits just the password or omits both login and password.
CVE-2024-2004 Low 2024-03-27 Not applicable No public exploit When a protocol selection parameter option disables all protocols without adding any then the default set of protocols would remain in the allowed set due to an error in the logic for removing protocols. The below command would perform a request to curl.se with a plaintext protocol which has been explicitly disabled. curl --proto -all,-http http://curl.se The flaw is only present if the set of selected protocols disables the entire set of available protocols, in itself a command with no practical use and therefore unlikely to be encountered in real situations. The curl security team has thus assessed this to be low severity bug.
CVE-2024-1979 Low 2024-03-13 No exploit published No public exploit A vulnerability was found in Quarkus. In certain conditions related to the CI process, git credentials could be inadvertently published, which could put the git repository at risk.
CVE-2021-28163 Low 2021-04-01 No exploit published No public exploit In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory is deployed as a static webapp, inadvertently serving the webapps themselves and anything else that might be in that directory.
CVE-2020-35448 Low 2020-12-27 Not applicable No public exploit An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.35.1. A heap-based buffer over-read can occur in bfd_getl_signed_32 in libbfd.c because sh_entsize is not validated in _bfd_elf_slurp_secondary_reloc_section in elf.c.
CVE-2019-4666 Low 2020-02-13 Not applicable No public exploit IBM UrbanCode Deploy (UCD) 7.0.3 and IBM UrbanCode Build 6.1.5 could allow a local user to obtain sensitive information by unmasking certain secure values in documents. IBM X-Force ID: 171248.
CVE-2015-3010 Low 2015-06-16 Not applicable No public exploit ceph-deploy before 1.5.23 uses weak permissions (644) for ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
CVE-2015-4053 Low 2015-06-08 Not applicable No public exploit The admin command in ceph-deploy before 1.5.25 uses world-readable permissions for /etc/ceph/ceph.client.admin.keyring, which allows local users to obtain sensitive information by reading the file.
CVE-2012-6348 Low 2013-01-04 Not applicable No public exploit Centrify Deployment Manager 2.1.0.283, as distributed in Centrify Suite before 2012.5, allows local users to (1) overwrite arbitrary files via a symlink attack on the adcheckDMoutput temporary file, or (2) overwrite arbitrary files and consequently gain privileges via a symlink attack on the centrify.cmd.0 temporary file.
CVE-2011-4436 Low 2011-11-12 Not applicable No public exploit Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface on the Dell KACE K2000 System Deployment Appliance allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2008-2288 Low 2008-05-18 Not applicable No public exploit Symantec Altiris Deployment Solution 6.8.x and 6.9.x before 6.9.176 has insufficient access control for deletion and modification of registry keys, which allows local users to cause a denial of service or obtain sensitive information.
CVE-2008-1754 Low 2008-04-11 Not applicable No public exploit Symantec Altiris Deployment Solution before 6.9.164 stores the Deployment Solution Agent (aka AClient) password in cleartext in memory, which allows local users to obtain sensitive information by dumping the AClient.exe process memory.
CVE-2004-2609 Low 2004-12-31 Not applicable No public exploit The stuffit.com executable on Symantec PowerQuest DeployCenter 5.5 boot disks allows local users to obtain sensitive information (an unencrypted password for a Windows domain account) via four "stuffit /f:stuffit.dat" invocations, possibly due to a buffer overflow.