WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: Full✕Product git✕
Overview 7 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
7matches 0exploited0.0% 0CISA KEV0.0% 1public PoC14.3% 1EPSS ≥ 0.514.3%
Protected by Waratek 7 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 7 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 7 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 14.3% Proof of concept only 1 14.3% Forecast only 0 0.0% No public exploit 5 71.4%
split by peak 2 / quarter
Protected by Waratek: 7 Medium: 7 blocked by ARMR today: 7 No public exploit: 5Proof of concept only: 1Working exploit published: 1
Q4 191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 212 Protected by Waratek2 Medium2 blocked by ARMR today2 Working exploit published1 No public exploit1 Q3 210 Q4 210 Q1 220 Q2 221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q3 220 Q4 220 Q1 230 Q2 230 Q3 230 Q4 230 Q1 240 Q2 240 Q3 240 Q4 240 Q1 250 Q2 251 Protected by Waratek1 Medium1 blocked by ARMR today1 Proof of concept only1 Q3 251 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Q4 251 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25Q4 25
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-62254 Medium 2025-10-23 Protected by Waratek No public exploit The ComboServlet in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.2, 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not limit the number or size of the files it will combine, which allows remote attackers to create very large responses that lead to a denial of service attack via the URL query string.
CVE-2025-43813 Medium 2025-09-29 Protected by Waratek No public exploit Possible path traversal vulnerability and denial-of-service in the ComboServlet in Liferay Portal 7.4.0 through 7.4.3.107, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to access arbitrary CSS and JSS files and load the files multiple times via the query string in a URL.
CVE-2025-4949 Medium 2025-05-21 Protected by Waratek Proof of concept only In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experimental amazons3 git transport protocol allowing to store git pack files in an Amazon S3 bucket, are vulnerable to XML External Entity (XXE) attacks when parsing XML files. This vulnerability can lead to information disclosure, denial of service, and other security issues.
CVE-2022-30949 Medium 2022-05-17 Protected by Waratek No public exploit Jenkins REPO Plugin 1.14.0 and earlier allows attackers able to configure pipelines to check out some SCM repositories stored on the Jenkins controller's file system using local paths as SCM URLs, obtaining limited information about other projects' SCM contents.
CVE-2021-29425 Medium 2021-04-13 Protected by Waratek No public exploit In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly providing access to files in the parent directory, but not further above (thus "limited" path traversal), if the calling code would use the result to construct a path value.
CVE-2021-28164 Medium 2021-04-01 Protected by Waratek Working exploit published In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
CVE-2019-10219 Medium 2019-11-08 Protected by Waratek No public exploit A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.