WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: Full✕Product git✕
Overview 14 matches · 1 exploited · 1 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
14matches 1exploited7.1% 1CISA KEV7.1% 3public PoC21.4% 1EPSS ≥ 0.57.1%
Protected by Waratek 14 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 14 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 14 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 7.1% Working exploit published 1 7.1% Proof of concept only 1 7.1% Forecast only 0 0.0% No public exploit 11 78.6%
split by peak 5 / year
Protected by Waratek: 14 High: 14 blocked by ARMR today: 14 No public exploit: 11Proof of concept only: 1Working exploit published: 1Exploited: 1
20171 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 20180 20191 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 20202 Protected by Waratek2 High2 blocked by ARMR today2 No public exploit2 20211 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20225 Protected by Waratek5 High5 blocked by ARMR today5 Working exploit published1 No public exploit4 20231 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20241 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20251 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20261 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
2017201820192020202120222023202420252026
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-48827 High 2026-06-01 Protected by Waratek No public exploit Path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git-upload-pack, git-receive-pack, and other git operations allows users authenticated over SSH access to git repositories outside the configured git server root directory. Applications are affected if they use org.apache.sshd:sshd-git. Applications not using sshd-git are not affected. Users are advised to upgrade affected applications to Apche MINA SSHD 2.18.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M3 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git. Upgrade affected applications to 3.0.0-M4. We would like to point out that a professional git server should not rely solely on file system layout and permissions, but should implement additional security controls to govern access to git repositories and operations allowed on particular git repositories.
CVE-2025-3594 High 2025-06-16 Protected by Waratek No public exploit Path traversal vulnerability with the downloading and installation of Xuggler in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.4 GA, 7.3 GA through update 34, and older unsupported versions allows remote attackers to (1) add files to arbitrary locations on the server and (2) download and execute arbitrary files from the download server via the `_com_liferay_server_admin_web_portlet_ServerAdminPortlet_jarName` parameter.
CVE-2024-25606 High 2024-02-20 Protected by Waratek No public exploit XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before update 12, 7.2 before fix pack 20, and older unsupported versions allows attackers with permission to deploy widgets/portlets/extensions to obtain sensitive information or consume system resources via the Java2WsddTask._format method.
CVE-2023-33945 High 2023-05-24 Protected by Waratek No public exploit SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is only exploitable when chained with other attacks. To exploit this vulnerability, the attacker must modify the database and wait for the application to be upgraded.
CVE-2022-42125 High 2022-11-15 Protected by Waratek No public exploit Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create or overwrite existing files on the filesystem via the deployment of a malicious plugin/module.
CVE-2022-42123 High 2022-11-15 Protected by Waratek No public exploit A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19 allows attackers to create or overwrite existing files on the filesystem via the installation of a malicious Elasticsearch Sidecar plugin.
CVE-2022-42121 High 2022-11-15 Protected by Waratek No public exploit A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3 before service pack 3, and 7.4 GA allows remote authenticated attackers to execute arbitrary SQL commands via a crafted payload injected into a page template's 'Name' field.
CVE-2022-31268 High 2022-05-21 Protected by Waratek Working exploit published A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname).
CVE-2022-30947 High 2022-05-17 Protected by Waratek No public exploit Jenkins Git Plugin 4.11.1 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVE-2021-37136 High 2021-10-19 Protected by Waratek No public exploit The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack
CVE-2020-15842 High 2020-07-20 Protected by Waratek No public exploit Liferay Portal before 7.3.0, and Liferay DXP 7.0 before fix pack 90, 7.1 before fix pack 17, and 7.2 before fix pack 5, allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads, because of insecure deserialization.
CVE-2020-14195 High 2020-06-16 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
CVE-2019-10392 High 2019-09-12 Protected by Waratek Proof of concept only Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection.
CVE-2017-9805 High 2017-09-15 Protected by Waratek Exploited The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering, which can lead to Remote Code Execution when deserializing XML payloads.