WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product fop✕
Overview 14 matches · 2 in Waratek scope · 2 protected · 4 exploited · 1 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
14matches 2in Waratek scope14.3% 2protected14.3% 4exploited28.6% 1CISA KEV7.1% 1public PoC7.1% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 14.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 12 85.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 9 64.3% Medium 5 35.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 14.3% partly blocked 0 0.0% not blocked 12 85.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 4 28.6% Working exploit published 1 7.1% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 9 64.3%
split by peak 1 / year
Not applicable: 12Protected by Waratek: 2 Medium: 5High: 9 not blocked: 12blocked by ARMR today: 2 No public exploit: 9Working exploit published: 1Exploited: 4
20021 Not applicable1 Medium1 not blocked1 No public exploit1 20030 20041 Not applicable1 High1 not blocked1 Working exploit published1 20050 20061 Not applicable1 High1 not blocked1 No public exploit1 20071 Not applicable1 High1 not blocked1 Exploited1 20081 Not applicable1 High1 not blocked1 No public exploit1 20090 20101 Not applicable1 Medium1 not blocked1 No public exploit1 20111 Not applicable1 Medium1 not blocked1 No public exploit1 20121 Not applicable1 Medium1 not blocked1 Exploited1 20131 Not applicable1 Medium1 not blocked1 Exploited1 20140 20151 Not applicable1 High1 not blocked1 No public exploit1 20161 Not applicable1 High1 not blocked1 Exploited1 20171 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20181 Not applicable1 High1 not blocked1 No public exploit1 20190 20200 20210 20220 20230 20241 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
200220042006200820102012201420162018202020222024
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-28168 High 2024-10-09 Protected by Waratek No public exploit Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.
CVE-2018-8173 High 2018-05-09 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "Microsoft InfoPath Remote Code Execution Vulnerability." This affects Microsoft Infopath.
CVE-2017-5661 High 2017-04-18 Protected by Waratek No public exploit In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
CVE-2016-0021 High 2016-03-09 Not applicable Exploited Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVE-2015-2503 High 2015-11-11 Not applicable No public exploit Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2, Excel 2010 SP2, InfoPath 2010 SP2, OneNote 2010 SP2, PowerPoint 2010 SP2, Project 2010 SP2, Publisher 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Pinyin IME 2010, Access 2013 SP1, Excel 2013 SP1, InfoPath 2013 SP1, OneNote 2013 SP1, PowerPoint 2013 SP1, Project 2013 SP1, Publisher 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, OneNote 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Access 2016, Excel 2016, OneNote 2016, PowerPoint 2016, Project 2016, Publisher 2016, Visio 2016, Word 2016, Skype for Business 2016, and Lync 2013 SP1 allow remote attackers to bypass a sandbox protection mechanism and gain privileges via a crafted web site that is accessed with Internet Explorer, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Microsoft Office Elevation of Privilege Vulnerability."
CVE-2013-1289 Medium 2013-04-09 Not applicable Exploited Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."
CVE-2012-2520 Medium 2012-10-09 Not applicable Exploited Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3 and 2010 SP1, Groove Server 2010 SP1, Windows SharePoint Services 3.0 SP2, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted string, aka "HTML Sanitization Vulnerability."
CVE-2011-1280 Medium 2011-06-16 Not applicable No public exploit The XML Editor in Microsoft InfoPath 2007 SP2 and 2010; SQL Server 2005 SP3 and SP4 and 2008 SP1, SP2, and R2; SQL Server Management Studio Express (SSMSE) 2005; and Visual Studio 2005 SP1, 2008 SP1, and 2010 does not properly handle external entities, which allows remote attackers to read arbitrary files via a crafted .disco (Web Service Discovery) file, aka "XML External Entities Resolution Vulnerability."
CVE-2010-1257 Medium 2010-06-08 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the toStaticHTML API, as used in Microsoft Office InfoPath 2003 SP3, 2007 SP1, and 2007 SP2; Office SharePoint Server 2007 SP1 and SP2; SharePoint Services 3.0 SP1 and SP2; and Internet Explorer 8 allows remote attackers to inject arbitrary web script or HTML via vectors related to sanitization.
CVE-2008-3068 High 2008-07-07 Not applicable No public exploit Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
CVE-2007-0671 High 2007-02-03 Not applicable Exploited Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.
CVE-2006-3877 High 2006-10-10 Not applicable No public exploit Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via an unspecified "crafted file," a different vulnerability than CVE-2006-3435, CVE-2006-4694, and CVE-2006-3876.
CVE-2004-0200 High 2004-09-28 Not applicable Working exploit published Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.
CVE-2002-2372 Medium 2002-12-31 Not applicable No public exploit The telnet server in Infoprint 21 running controller software before 1.056007 allows remote attackers to cause a denial of service (crash) via a long username, possibly due to a buffer overflow.