Overview 31 matches · 0 in Waratek scope · 0 protected · 2 exploited · 2 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
31matches
0in Waratek scope0.0%
0protected0.0%
2exploited6.5%
2CISA KEV6.5%
1public PoC3.2%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
3.2%
Not applicable
30
96.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
31
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
2
6.5%
Working exploit published
1
3.2%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
28
90.3%
split by
peak 23 / year
20131
Not applicable1
Medium1
not blocked1
Exploited1
20140
20152
Outside Waratek scope1
Not applicable1
Medium2
not blocked2
Exploited1
Working exploit published1
20161
Not applicable1
Medium1
not blocked1
No public exploit1
20170
20181
Not applicable1
Medium1
not blocked1
No public exploit1
201923
Not applicable23
Medium23
not blocked23
No public exploit23
20200
20210
20221
Not applicable1
Medium1
not blocked1
No public exploit1
20230
20242
Not applicable2
Medium2
not blocked2
No public exploit2
201320142015201620172018201920202021202220232024
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-0408 | Medium | 2024-01-18 | Not applicable | No public exploit | A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL. |
| CVE-2023-5455 | Medium | 2024-01-10 | Not applicable | No public exploit | A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt. |
| CVE-2016-2124 | Medium | 2022-02-18 | Not applicable | No public exploit | A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required. |
| CVE-2019-13763 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. |
| CVE-2019-13761 | Medium | 2019-12-10 | Not applicable | No public exploit | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
| CVE-2019-13759 | Medium | 2019-12-10 | Not applicable | No public exploit | Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
| CVE-2019-13758 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. |
| CVE-2019-13757 | Medium | 2019-12-10 | Not applicable | No public exploit | Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
| CVE-2019-13756 | Medium | 2019-12-10 | Not applicable | No public exploit | Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
| CVE-2019-13755 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page. |
| CVE-2019-13754 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. |
| CVE-2019-13753 | Medium | 2019-12-10 | Not applicable | No public exploit | Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
| CVE-2019-13752 | Medium | 2019-12-10 | Not applicable | No public exploit | Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
| CVE-2019-13751 | Medium | 2019-12-10 | Not applicable | No public exploit | Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
| CVE-2019-13750 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page. |
| CVE-2019-13749 | Medium | 2019-12-10 | Not applicable | No public exploit | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
| CVE-2019-13748 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
| CVE-2019-13746 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. |
| CVE-2019-13744 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
| CVE-2019-13743 | Medium | 2019-12-10 | Not applicable | No public exploit | Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI via a crafted HTML page. |
| CVE-2019-13742 | Medium | 2019-12-10 | Not applicable | No public exploit | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name. |
| CVE-2019-13740 | Medium | 2019-12-10 | Not applicable | No public exploit | Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page. |
| CVE-2019-13739 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. |
| CVE-2019-13738 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page. |
| CVE-2019-13737 | Medium | 2019-12-10 | Not applicable | No public exploit | Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. |
| CVE-2019-7317 | Medium | 2019-02-04 | Not applicable | No public exploit | png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute. |
| CVE-2017-15129 | Medium | 2018-01-09 | Not applicable | No public exploit | A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel before 4.14.11. The function get_net_ns_by_id() in net/core/net_namespace.c does not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely. |
| CVE-2016-5009 | Medium | 2016-07-12 | Not applicable | No public exploit | The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix. |
| CVE-2015-4902 | Medium | 2015-10-22 | Outside Waratek scope | Exploited | Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment. |
| CVE-2015-3214 | Medium | 2015-08-31 | Not applicable | Working exploit published | The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index. |
| CVE-2013-1675 | Medium | 2013-05-16 | Not applicable | Exploited | Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, which allows remote attackers to obtain sensitive information from process memory via a crafted web site. |