WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product fop✕
Overview 9 matches · 2 in Waratek scope · 2 protected · 2 exploited · 1 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
9matches 2in Waratek scope22.2% 2protected22.2% 2exploited22.2% 1CISA KEV11.1% 1public PoC11.1% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 22.2% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 7 77.8% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 9 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 22.2% partly blocked 0 0.0% not blocked 7 77.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 22.2% Working exploit published 1 11.1% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 66.7%
split by peak 1 / year
Not applicable: 7Protected by Waratek: 2 High: 9 not blocked: 7blocked by ARMR today: 2 No public exploit: 6Working exploit published: 1Exploited: 2
20041 Not applicable1 High1 not blocked1 Working exploit published1 20050 20061 Not applicable1 High1 not blocked1 No public exploit1 20071 Not applicable1 High1 not blocked1 Exploited1 20081 Not applicable1 High1 not blocked1 No public exploit1 20090 20100 20110 20120 20130 20140 20151 Not applicable1 High1 not blocked1 No public exploit1 20161 Not applicable1 High1 not blocked1 Exploited1 20171 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20181 Not applicable1 High1 not blocked1 No public exploit1 20190 20200 20210 20220 20230 20241 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
20042006200820102012201420162018202020222024
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-28168 High 2024-10-09 Protected by Waratek No public exploit Improper Restriction of XML External Entity Reference ('XXE') vulnerability in Apache XML Graphics FOP. This issue affects Apache XML Graphics FOP: 2.9. Users are recommended to upgrade to version 2.10, which fixes the issue.
CVE-2018-8173 High 2018-05-09 Not applicable No public exploit A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "Microsoft InfoPath Remote Code Execution Vulnerability." This affects Microsoft Infopath.
CVE-2017-5661 High 2017-04-18 Protected by Waratek No public exploit In Apache FOP before 2.2, files lying on the filesystem of the server which uses FOP can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.
CVE-2016-0021 High 2016-03-09 Not applicable Exploited Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
CVE-2015-2503 High 2015-11-11 Not applicable No public exploit Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2, Excel 2010 SP2, InfoPath 2010 SP2, OneNote 2010 SP2, PowerPoint 2010 SP2, Project 2010 SP2, Publisher 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Pinyin IME 2010, Access 2013 SP1, Excel 2013 SP1, InfoPath 2013 SP1, OneNote 2013 SP1, PowerPoint 2013 SP1, Project 2013 SP1, Publisher 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, OneNote 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Access 2016, Excel 2016, OneNote 2016, PowerPoint 2016, Project 2016, Publisher 2016, Visio 2016, Word 2016, Skype for Business 2016, and Lync 2013 SP1 allow remote attackers to bypass a sandbox protection mechanism and gain privileges via a crafted web site that is accessed with Internet Explorer, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Microsoft Office Elevation of Privilege Vulnerability."
CVE-2008-3068 High 2008-07-07 Not applicable No public exploit Microsoft Crypto API 5.131.2600.2180 through 6.0, as used in Outlook, Windows Live Mail, and Office 2007, performs Certificate Revocation List (CRL) checks by using an arbitrary URL from a certificate embedded in a (1) S/MIME e-mail message or (2) signed document, which allows remote attackers to obtain reading times and IP addresses of recipients, and port-scan results, via a crafted certificate with an Authority Information Access (AIA) extension.
CVE-2007-0671 High 2007-02-03 Not applicable Exploited Unspecified vulnerability in Microsoft Excel 2000, XP, 2003, and 2004 for Mac, and possibly other Office products, allows remote user-assisted attackers to execute arbitrary code via unknown attack vectors, as demonstrated by Exploit-MSExcel.h in targeted zero-day attacks.
CVE-2006-3877 High 2006-10-10 Not applicable No public exploit Unspecified vulnerability in PowerPoint in Microsoft Office 2000, Office 2002, Office 2003, Office 2004 for Mac, and Office v.X for Mac allows user-assisted attackers to execute arbitrary code via an unspecified "crafted file," a different vulnerability than CVE-2006-3435, CVE-2006-4694, and CVE-2006-3876.
CVE-2004-0200 High 2004-09-28 Not applicable Working exploit published Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length before a memory copy operation.