Overview 24 matches · 1 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 5 public PoC · 0 EPSS ≥ 0.5
24matches
1in Waratek scope4.2%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
5public PoC20.8%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
4.2%
Outside Waratek scope
0
0.0%
Not applicable
23
95.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
24
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
5
20.8%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
19
79.2%
split by
peak 4 / year
20042
Not applicable2
Medium2
not blocked2
No public exploit2
20054
Not applicable4
Medium4
not blocked4
Working exploit published2
No public exploit2
20060
20071
Not applicable1
Medium1
not blocked1
Working exploit published1
20080
20092
Not applicable2
Medium2
not blocked2
Working exploit published2
20101
Not applicable1
Medium1
not blocked1
No public exploit1
20110
20124
Not applicable4
Medium4
not blocked4
No public exploit4
20130
20140
20150
20161
Not applicable1
Medium1
not blocked1
No public exploit1
20170
20180
20192
Not applicable2
Medium2
not blocked2
No public exploit2
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20214
Not applicable4
Medium4
not blocked4
No public exploit4
20222
No exploit published1
Not applicable1
Medium2
not blocked2
No public exploit2
2004200620082010201220142016201820202022
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2022-47500 | Medium | 2022-12-19 | No exploit published | No public exploit | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrade to 1.1.0 to fix this issue. |
| CVE-2022-1107 | Medium | 2022-04-22 | Not applicable | No public exploit | During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code. |
| CVE-2021-3786 | Medium | 2021-11-12 | Not applicable | No public exploit | A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range. |
| CVE-2021-3599 | Medium | 2021-11-12 | Not applicable | No public exploit | A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code. |
| CVE-2021-3453 | Medium | 2021-07-16 | Not applicable | No public exploit | Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage. |
| CVE-2021-28973 | Medium | 2021-04-13 | Not applicable | No public exploit | The XML Import functionality of the Administration console in Perforce Helix ALM 2020.3.1 Build 22 accepts XML input data that is parsed by insecurely configured software components, leading to XXE attacks. |
| CVE-2020-8323 | Medium | 2020-06-09 | Not applicable | No public exploit | A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStation, and Lenovo Notebook models may allow arbitrary code execution. |
| CVE-2019-6172 | Medium | 2019-11-12 | Not applicable | No public exploit | A potential vulnerability in the SMI callback function used in Legacy USB driver using passed parameter without sufficient checking in some Lenovo ThinkPad models may allow arbitrary code execution. |
| CVE-2019-6170 | Medium | 2019-11-12 | Not applicable | No public exploit | A potential vulnerability in the SMI callback function used in the Legacy USB driver using boot services structure in runtime phase in some Lenovo ThinkPad models may allow arbitrary code execution. |
| CVE-2016-8222 | Medium | 2016-11-30 | Not applicable | No public exploit | A vulnerability has been identified in a signed kernel driver for the BIOS of some ThinkPad systems that can allow an attacker with Windows administrator-level privileges to call System Management Mode (SMM) services. This could lead to a denial of service attack or allow certain BIOS variables or settings to be altered (such as boot sequence). The setting or changing of BIOS passwords is not affected by this vulnerability. |
| CVE-2012-2268 | Medium | 2012-04-17 | Not applicable | No public exploit | master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (unhandled exception and daemon crash) via a crafted Open-PDU request that triggers incorrect DisplayString processing, a different vulnerability than CVE-2012-1923. |
| CVE-2012-2267 | Medium | 2012-04-17 | Not applicable | No public exploit | master.exe in the SNMP Master Agent in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to cause a denial of service (daemon crash) by establishing and closing a port-705 TCP connection, a different vulnerability than CVE-2012-1923. |
| CVE-2012-1985 | Medium | 2012-04-17 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allows remote attackers to hijack the authentication of administrators for requests that cause a denial of service (stack consumption and daemon crash) via a malformed URL. |
| CVE-2012-1984 | Medium | 2012-04-17 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in RealNetworks Helix Server and Helix Mobile Server 14.x before 14.3.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
| CVE-2010-0417 | Medium | 2010-02-18 | Not applicable | No public exploit | Buffer overflow in common/util/rlstate.cpp in Helix Player 1.0.6 and RealPlayer allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a RuleBook structure with a large number of rule-separator characters that trigger heap memory corruption. |
| CVE-2009-2534 | Medium | 2009-07-20 | Not applicable | Working exploit published | RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allow remote attackers to cause a denial of service (daemon crash) via an RTSP SETUP request that (1) specifies the / URI or (2) lacks a / character in the URI. |
| CVE-2009-2533 | Medium | 2009-07-20 | Not applicable | Working exploit published | rmserver in RealNetworks Helix Server and Helix Mobile Server before 13.0.0 allows remote attackers to cause a denial of service (daemon exit) via multiple RTSP SET_PARAMETER requests with empty DataConvertBuffer headers. |
| CVE-2007-4904 | Medium | 2007-09-17 | Not applicable | Working exploit published | RealNetworks RealPlayer 10.1.0.3114 and earlier, and Helix Player 1.0.6.778 on Fedora Core 6 (FC6) and possibly other platforms, allow user-assisted remote attackers to cause a denial of service (application crash) via a malformed .au file that triggers a divide-by-zero error. |
| CVE-2005-2629 | Medium | 2005-11-18 | Not applicable | Working exploit published | Integer overflow in RealNetworks RealPlayer 8, 10, and 10.5, RealOne Player 1 and 2, and Helix Player 10.0.0 allows remote attackers to execute arbitrary code via an .rm movie file with a large value in the length field of the first data packet, which leads to a stack-based buffer overflow, a different vulnerability than CVE-2004-1481. |
| CVE-2005-2710 | Medium | 2005-09-27 | Not applicable | Working exploit published | Format string vulnerability in Real HelixPlayer and RealPlayer 10 allows remote attackers to execute arbitrary code via the (1) image handle or (2) timeformat attribute in a RealPix (.rp) or RealText (.rt) file. |
| CVE-2005-0611 | Medium | 2005-05-02 | Not applicable | No public exploit | Heap-based buffer overflow in RealNetworks RealPlayer 10.5 (6.0.12.1056 and earlier), 10, 8, and RealOne Player V2 and V1, allows remote attackers to execute arbitrary code via .WAV files. |
| CVE-2005-0755 | Medium | 2005-04-19 | Not applicable | No public exploit | Heap-based buffer overflow in RealPlayer 10 and earlier, Helix Player before 10.0.4, and RealOne Player v1 and v2 allows remote attackers to execute arbitrary code via a long hostname in a RAM file. |
| CVE-2004-1481 | Medium | 2004-12-31 | Not applicable | No public exploit | Integer overflow in pnen3260.dll in RealPlayer 8 through 10.5 (6.0.12.1040) and earlier, and RealOne Player 1 or 2 on Windows or Mac OS, allows remote attackers to execute arbitrary code via a SMIL file and a .rm movie file with a large length field for the data chunk, which leads to a heap-based buffer overflow. |
| CVE-2004-0049 | Medium | 2004-02-17 | Not applicable | No public exploit | Helix Universal Server/Proxy 9 and Mobile Server 10 allow remote attackers to cause a denial of service via certain HTTP POST messages to the Administration System port. |