WaratekVRT Sign in
Reset
More filters (2)
Columns
Published to 2020-09-30✕Product java✕
Overview 8 matches · 4 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
8matches 4protected50.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC12.5% 0EPSS ≥ 0.50.0%
Protected by Waratek 4 50.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 50.0%
Critical 8 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 50.0% partly blocked 0 0.0% not blocked 4 50.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 12.5% Forecast only 0 0.0% No public exploit 7 87.5%
split by peak 2 / quarter
No exploit published: 4Protected by Waratek: 4 Critical: 8 not blocked: 4blocked by ARMR today: 4 No public exploit: 7Proof of concept only: 1
Q3 151 No exploit published1 Critical1 not blocked1 No public exploit1 Q4 150 Q1 160 Q2 161 No exploit published1 Critical1 not blocked1 No public exploit1 Q3 160 Q4 160 Q1 170 Q2 170 Q3 170 Q4 170 Q1 180 Q2 180 Q3 182 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 Q4 180 Q1 192 Protected by Waratek2 Critical2 blocked by ARMR today2 Proof of concept only1 No public exploit1 Q2 190 Q3 190 Q4 190 Q1 200 Q2 201 No exploit published1 Critical1 not blocked1 No public exploit1 Q3 201 No exploit published1 Critical1 not blocked1 No public exploit1
Q3 15Q1 16Q3 16Q1 17Q3 17Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-7692 Critical 2020-07-09 No exploit published No public exploit PKCE support is not implemented in accordance with the RFC for OAuth 2.0 for Native Apps. Without the use of PKCE, the authorization code returned by an authorization server is not enough to guarantee that the client that issued the initial authorization request is the one that will be authorized. An attacker is able to obtain the authorization code using a malicious app on the client-side and use it to gain authorization to the protected resource. This affects the package com.google.oauth-client:google-oauth-client before 1.31.0.
CVE-2020-11050 Critical 2020-05-07 No exploit published No public exploit In Java-WebSocket less than or equal to 1.4.1, there is an Improper Validation of Certificate with Host Mismatch where WebSocketClient does not perform SSL hostname validation. This has been patched in 1.5.0.
CVE-2018-11788 Critical 2019-01-07 Protected by Waratek Proof of concept only Apache Karaf provides a features deployer, which allows users to "hot deploy" a features XML by dropping the file directly in the deploy folder. The features XML is parsed by XMLInputFactory class. Apache Karaf XMLInputFactory class doesn't contain any mitigation codes against XXE. This is a potential security risk as an user can inject external XML entities in Apache Karaf version prior to 4.1.7 or 4.2.2. It has been fixed in Apache Karaf 4.1.7 and 4.2.2 releases.
CVE-2019-5312 Critical 2019-01-04 Protected by Waratek No public exploit An issue was discovered in weixin-java-tools v3.3.0. There is an XXE vulnerability in the getXmlDoc method of the BaseWxPayResult.java file. NOTE: this issue exists because of an incomplete fix for CVE-2018-20318.
CVE-2018-15531 Critical 2018-09-26 Protected by Waratek No public exploit JavaMelody before 1.74.0 has XXE via parseSoapMethodName in bull/javamelody/PayloadNameRequestWrapper.java.
CVE-2018-1000613 Critical 2018-07-09 Protected by Waratek No public exploit Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.
CVE-2015-5041 Critical 2016-06-06 No exploit published No public exploit The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.
CVE-2015-0192 Critical 2015-07-02 No exploit published No public exploit Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine.