WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product derby✕
Overview 10 matches · 3 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
10matches 3in Waratek scope30.0% 1protected10.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 10.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 20.0% Outside Waratek scope 1 10.0% Not applicable 6 60.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 10 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 10.0% partly blocked 0 0.0% not blocked 9 90.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 2 20.0% Forecast only 0 0.0% No public exploit 8 80.0%
split by peak 5 / year
Not applicable: 6Outside Waratek scope: 1No exploit published: 2Protected by Waratek: 1 Medium: 10 not blocked: 9blocked by ARMR today: 1 No public exploit: 8Proof of concept only: 2
20051 No exploit published1 Medium1 not blocked1 No public exploit1 20060 20072 Protected by Waratek1 No exploit published1 Medium2 blocked by ARMR today1 not blocked1 No public exploit2 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20181 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 20190 20200 20210 20221 Not applicable1 Medium1 not blocked1 No public exploit1 20230 20245 Not applicable5 Medium5 not blocked5 Proof of concept only2 No public exploit3
2006200820102012201420162018202020222024
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-30927 Medium 2024-04-18 Not applicable Proof of concept only Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component.
CVE-2024-30926 Medium 2024-04-18 Not applicable No public exploit Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component.
CVE-2024-30925 Medium 2024-04-18 Not applicable Proof of concept only Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component.
CVE-2024-30924 Medium 2024-04-18 Not applicable No public exploit Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the checkin.php component.
CVE-2024-30921 Medium 2024-04-18 Not applicable No public exploit Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component.
CVE-2022-1320 Medium 2022-05-23 Not applicable No public exploit The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
CVE-2018-1313 Medium 2018-05-07 Outside Waratek scope No public exploit In Apache Derby 10.3.1.4 to 10.14.1.0, a specially-crafted network packet can be used to request the Derby Network Server to boot a database whose location and contents are under the user's control. If the Derby Network Server is not running with a Java Security Manager policy file, the attack is successful. If the server is using a policy file, the policy file must permit the database location to be read for the attack to work. The default Derby Network Server policy file distributed with the affected releases includes a permissive policy as the default Network Server policy, which allows the attack to work.
CVE-2006-7217 Medium 2007-07-05 Protected by Waratek No public exploit Apache Derby before 10.2.1.6 does not determine schema privilege requirements during the DropSchemaNode bind phase, which allows remote authenticated users to execute arbitrary drop schema statements in SQL authorization mode.
CVE-2006-7216 Medium 2007-07-05 No exploit published No public exploit Apache Derby before 10.2.1.6 does not determine privilege requirements for lock table statements at compilation time, and consequently does not enforce privilege requirements at execution time, which allows remote authenticated users to lock arbitrary tables.
CVE-2005-4849 Medium 2005-12-31 No exploit published No public exploit Apache Derby before 10.1.2.1 exposes the (1) user and (2) password attributes in cleartext via (a) the RDBNAM parameter of the ACCSEC command and (b) the output of the DatabaseMetaData.getURL function, which allows context-dependent attackers to obtain sensitive information.