WaratekVRT Sign in
Reset
More filters (1)
Columns
Product flexcube private banking✕
Overview 13 matches · 2 exploited · 1 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
13matches 2exploited15.4% 1CISA KEV7.7% 1public PoC7.7% 2EPSS ≥ 0.515.4%
Protected by Waratek 13 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 4 30.8% High 4 30.8% Medium 5 38.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 13 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 15.4% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 11 84.6%
split by peak 2 / quarter
Protected by Waratek: 13 Medium: 5High: 4Critical: 4 blocked by ARMR today: 13 No public exploit: 11Exploited: 2
Q2 161 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q3 160 Q4 160 Q1 170 Q2 170 Q3 170 Q4 170 Q1 180 Q2 181 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q3 180 Q4 180 Q1 191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 192 Protected by Waratek2 High2 blocked by ARMR today2 No public exploit2 Q3 191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 192 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 Q1 201 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q2 202 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 Q3 201 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q4 200 Q1 210 Q2 210 Q3 210 Q4 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1
Q2 16Q4 16Q2 17Q4 17Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-44832 Medium 2021-12-28 Protected by Waratek Exploited Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVE-2020-11998 Critical 2020-09-10 Protected by Waratek No public exploit A regression has been introduced in the commit preventing JMX re-bind. By passing an empty environment map to RMIConnectorServer, instead of the map that contains the authentication credentials, it leaves ActiveMQ open to the following attack: https://docs.oracle.com/javase/8/docs/technotes/guides/management/agent.html "A remote client could create a javax.management.loading.MLet MBean and use it to create new MBeans from arbitrary URLs, at least if there is no security manager. In other words, a rogue remote client could make your Java application execute arbitrary code." Mitigation: Upgrade to Apache ActiveMQ 5.15.13
CVE-2020-11973 Critical 2020-05-14 Protected by Waratek No public exploit Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
CVE-2020-11972 Critical 2020-05-14 Protected by Waratek No public exploit Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x users should upgrade to 3.2.0.
CVE-2020-5397 Medium 2020-01-17 Protected by Waratek No public exploit Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux (spring-webflux module) endpoints. Only non-authenticated endpoints are vulnerable because preflight requests should not include credentials and therefore requests should fail authentication. However a notable exception to this are Chrome based browsers when using client certificates for authentication since Chrome sends TLS client certificates in CORS preflight requests in violation of spec requirements. No HTTP body can be sent or received as a result of this attack.
CVE-2019-10219 Medium 2019-11-08 Protected by Waratek No public exploit A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
CVE-2019-12415 Medium 2019-10-23 Protected by Waratek No public exploit In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.
CVE-2019-10086 High 2019-08-20 Protected by Waratek No public exploit In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVE-2019-0188 High 2019-05-28 Protected by Waratek No public exploit Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the camel-xmljson component, which was removed.
CVE-2019-5427 High 2019-04-22 Protected by Waratek No public exploit c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading configuration.
CVE-2019-3773 Critical 2019-01-18 Protected by Waratek No public exploit Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.
CVE-2018-10237 Medium 2018-04-26 Protected by Waratek No public exploit Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
CVE-2016-3081 High 2016-04-26 Protected by Waratek Exploited Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.