java CVEs | Waratek

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5

3matches 1protected33.3% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%

Protected by Waratek 1 33.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 66.7%

Critical 1 33.3% High 1 33.3% Medium 1 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 1 33.3% partly blocked 0 0.0% not blocked 2 66.7% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 100.0%

split by StatusSeverityProtectionExploit maturity peak 3 / month

Jul 243 Protected by Waratek1 No exploit published2 Critical1 High1 Medium1 blocked by ARMR today1 not blocked2 No public exploit3

Jul 24

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2024-40094	Medium	2024-07-30	No exploit published	No public exploit	GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.
CVE-2023-48362	Critical	2024-07-24	Protected by Waratek	No public exploit	XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.
CVE-2024-25638	High	2024-07-22	No exploit published	No public exploit	dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2024-40094

Medium

2024-07-30

No exploit published

No public exploit

GraphQL Java (aka graphql-java) before 21.5 does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service via introspection queries. 20.9 and 19.11 are also fixed versions.

CVE-2023-48362

Critical

2024-07-24

Protected by Waratek

No public exploit

XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.

CVE-2024-25638

High

2024-07-22

No exploit published

No public exploit

dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.