WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product network security manager✕
Overview 13 matches · 1 in Waratek scope · 1 protected · 1 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
13matches 1in Waratek scope7.7% 1protected7.7% 1exploited7.7% 0CISA KEV0.0% 3public PoC23.1% 1EPSS ≥ 0.57.7%
Protected by Waratek 1 7.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 12 92.3% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 13 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 7.7% partly blocked 0 0.0% not blocked 12 92.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 7.7% Working exploit published 2 15.4% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 10 76.9%
split by peak 5 / year
Not applicable: 12Protected by Waratek: 1 Medium: 13 not blocked: 12blocked by ARMR today: 1 No public exploit: 10Working exploit published: 2Exploited: 1
20092 Not applicable2 Medium2 not blocked2 Working exploit published2 20100 20110 20120 20130 20141 Not applicable1 Medium1 not blocked1 No public exploit1 20150 20160 20170 20185 Not applicable5 Medium5 not blocked5 No public exploit5 20191 Not applicable1 Medium1 not blocked1 No public exploit1 20202 Not applicable2 Medium2 not blocked2 No public exploit2 20212 Protected by Waratek1 Not applicable1 Medium2 blocked by ARMR today1 not blocked1 Exploited1 No public exploit1
2009201120132015201720192021
13 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-45105 Medium 2021-12-18 Protected by Waratek Exploited Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2021-4038 Medium 2021-12-09 Not applicable No public exploit Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in all scenarios.
CVE-2020-7258 Medium 2020-03-18 Not applicable No public exploit Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
CVE-2020-7256 Medium 2020-03-18 Not applicable No public exploit Cross site scripting vulnerability in McAfee Network Security Management (NSM) Prior to 9.1 update 6 Mar 2020 Update allows attackers to unspecified impact via unspecified vectors.
CVE-2019-3602 Medium 2019-05-15 Not applicable No public exploit Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom rule containing HTML.
CVE-2018-6681 Medium 2018-07-17 Not applicable No public exploit Abuse of Functionality vulnerability in the web interface in McAfee Network Security Management (NSM) 9.1.7.11 and earlier allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via appliance web interface.
CVE-2017-3961 Medium 2018-05-25 Not applicable No public exploit Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows authenticated users to allow arbitrary HTML code to be reflected in the response web page via crafted user input of attributes.
CVE-2017-3967 Medium 2018-04-04 Not applicable No public exploit Target influence via framing vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to inject arbitrary web script or HTML via application pages inability to break out of 3rd party HTML frames.
CVE-2017-3966 Medium 2018-04-04 Not applicable No public exploit Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL.
CVE-2017-3964 Medium 2018-04-04 Not applicable No public exploit Reflective Cross-Site Scripting (XSS) vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows attackers to inject arbitrary web script or HTML via a URL parameter.
CVE-2014-2390 Medium 2014-08-29 Not applicable No public exploit Cross-site request forgery (CSRF) vulnerability in the User Management module in McAfee Network Security Manager (NSM) before 6.1.15.39 7.1.5.x before 7.1.5.15, 7.1.15.x before 7.1.15.7, 7.5.x before 7.5.5.9, and 8.x before 8.1.7.3 allows remote attackers to hijack the authentication of users for requests that modify user accounts via unspecified vectors.
CVE-2009-3566 Medium 2009-11-13 Not applicable Working exploit published McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 does not include the HTTPOnly flag in the Set-Cookie header for the session identifier, which allows remote attackers to hijack a session by leveraging a cross-site scripting (XSS) vulnerability.
CVE-2009-3565 Medium 2009-11-13 Not applicable Working exploit published Multiple cross-site scripting (XSS) vulnerabilities in intruvert/jsp/module/Login.jsp in McAfee IntruShield Network Security Manager (NSM) before 5.1.11.6 allow remote attackers to inject arbitrary web script or HTML via the (1) iaction or (2) node parameter.