WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product knowledge management✕
Overview 16 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 4 public PoC · 0 EPSS ≥ 0.5
16matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 4public PoC25.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 16 100.0% Withdrawn CVE 0 0.0%
Critical 1 6.2% High 4 25.0% Medium 11 68.8% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 16 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 4 25.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 12 75.0%
split by peak 5 / year
Not applicable: 16 Medium: 11High: 4Critical: 1 not blocked: 16 No public exploit: 12Working exploit published: 4
20062 Not applicable2 Medium2 not blocked2 Working exploit published2 20072 Not applicable2 High1 Medium1 not blocked2 Working exploit published2 20082 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20090 20100 20110 20120 20130 20140 20150 20160 20171 Not applicable1 Medium1 not blocked1 No public exploit1 20180 20190 20205 Not applicable5 Critical1 High1 Medium3 not blocked5 No public exploit5 20213 Not applicable3 High1 Medium2 not blocked3 No public exploit3 20220 20230 20241 Not applicable1 Medium1 not blocked1 No public exploit1
2006200820102012201420162018202020222024
16 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-34685 Medium 2024-07-09 Not applicable No public exploit Due to weak encoding of user-controlled input in SAP NetWeaver Knowledge Management XMLEditor which allows malicious scripts can be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application but it has a low impact on its confidentiality and integrity.
CVE-2021-37531 High 2021-09-14 Not applicable No public exploit SAP NetWeaver Knowledge Management XML Forms versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50, contains an XSLT vulnerability which allows a non-administrative authenticated attacker to craft a malicious XSL stylesheet file containing a script with OS-level commands, copy it into a location to be accessed by the system and then create a file which will trigger the XSLT engine to execute the script contained within the malicious XSL file. This can result in a full compromise of the confidentiality, integrity, and availability of the system.
CVE-2021-33707 Medium 2021-08-10 Not applicable No public exploit SAP NetWeaver Knowledge Management allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via a URL stored in a component. This could enable the attacker to compromise the user's confidentiality and integrity.
CVE-2021-21488 Medium 2021-03-09 Not applicable No public exploit Knowledge Management versions 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 allows a remote attacker with basic privileges to deserialize user-controlled data without verification, leading to insecure deserialization which triggers the attacker’s code, therefore impacting Availability.
CVE-2020-6326 Medium 2020-09-09 Not applicable No public exploit SAP NetWeaver (Knowledge Management), version-7.30,7.31,7.40,7.50, allows an authenticated attacker to create malicious links in the UI, when clicked by victim, will execute arbitrary java scripts thus extracting or modifying information otherwise restricted leading to Stored Cross Site Scripting.
CVE-2020-6293 Medium 2020-08-12 Not applicable No public exploit SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to upload a malicious file and also to access, modify or make unavailable existing files but the impact is limited to the files themselves and is restricted by other policies such as access control lists and other upload file size restrictions, leading to Unrestricted File Upload.
CVE-2020-6284 Critical 2020-08-12 Not applicable No public exploit SAP NetWeaver (Knowledge Management), versions - 7.30, 7.31, 7.40, 7.50, allows the automatic execution of script content in a stored file due to inadequate filtering with the accessing user's privileges. If the accessing user has administrative privileges, then the execution of the script content could result in complete compromise of system confidentiality, integrity and availability, leading to Stored Cross Site Scripting.
CVE-2020-6225 High 2020-04-14 Not applicable No public exploit SAP NetWeaver (Knowledge Management), versions (KMC-CM - 7.00, 7.01, 7.02, 7.30, 7.31, 7.40, 7.50 and KMC-WPC 7.30, 7.31, 7.40, 7.50), does not sufficiently validate path information provided by users, thus characters representing traverse to parent directory are passed through to the file APIs, allowing the attacker to overwrite, delete, or corrupt arbitrary files on the remote server, leading to Path Traversal.
CVE-2020-6193 Medium 2020-02-12 Not applicable No public exploit SAP NetWeaver (Knowledge Management ICE Service), versions 7.30, 7.31, 7.40, 7.50, allows an unauthenticated attacker to execute malicious scripts leading to Reflected Cross-Site Scripting (XSS) vulnerability.
CVE-2017-16678 Medium 2017-12-12 Not applicable No public exploit Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver Knowledge Management Configuration Service, EPBC and EPBC2 from 7.00 to 7.02; KMC-BC 7.30, 7.31, 7.40 and 7.50, that allows an attacker to manipulate the vulnerable application to send crafted requests on behalf of the application.
CVE-2008-1223 High 2008-03-10 Not applicable No public exploit Unspecified vulnerability in Dokeos 1.8.4 before SP3 allows attackers to execute arbitrary code via unspecified vectors.
CVE-2008-1222 Medium 2008-03-10 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in Dokeos 1.8.4 before SP3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2007-6574 Medium 2007-12-28 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in Dokeos 1.8.4 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the origin parameter to work/work.php in a display_upload_form action, or the forum parameter to (2) forum/viewforum.php or (3) forum/viewthread.php.
CVE-2007-2889 High 2007-05-30 Not applicable Working exploit published SQL injection vulnerability in tracking/courseLog.php in Dokeos 1.6.5 and earlier allows remote attackers to execute arbitrary SQL commands via the scormcontopen parameter.
CVE-2006-4844 Medium 2006-09-19 Not applicable Working exploit published PHP remote file inclusion vulnerability in inc/claro_init_local.inc.php in Claroline 1.7.7 and earlier, as used in Dokeos and possibly other products, allows remote attackers to execute arbitrary PHP code via a URL in the extAuthSource[newUser] parameter.
CVE-2006-2285 Medium 2006-05-10 Not applicable Working exploit published PHP remote file inclusion vulnerability in authldap.php in Dokeos 1.6.4 allows remote attackers to execute arbitrary PHP code via a URL in the includePath parameter.