Overview 5 matches · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
1
20.0%
No exploit published
4
80.0%
Outside Waratek scope
0
0.0%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
5
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
2
40.0%
Forecast only
0
0.0%
No public exploit
3
60.0%
split by
peak 2 / year
20171
Mitigation candidate1
Medium1
not blocked1
Proof of concept only1
20180
20191
No exploit published1
Medium1
not blocked1
No public exploit1
20200
20211
No exploit published1
High1
not blocked1
No public exploit1
20220
20232
No exploit published2
Medium2
not blocked2
Proof of concept only1
No public exploit1
2017201820192020202120222023
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2023-0833 | Medium | 2023-09-27 | No exploit published | No public exploit | A flaw was found in Red Hat's AMQ-Streams, which ships a version of the OKHttp component with an information disclosure flaw via an exception triggered by a header containing an illegal value. This issue could allow an authenticated attacker to access information outside of their regular permissions. |
| CVE-2023-3782 | Medium | 2023-07-19 | No exploit published | Proof of concept only | DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response |
| CVE-2021-0341 | High | 2021-02-10 | No exploit published | No public exploit | In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069 |
| CVE-2018-20200 | Medium | 2019-04-18 | No exploit published | No public exploit | CertificatePinner.java in OkHttp 3.x through 3.12.0 allows man-in-the-middle attackers to bypass certificate pinning by changing SSLContext and the boolean values while hooking the application. NOTE: This id is disputed because some parties don't consider this is a vulnerability. Their rationale can be found in https://github.com/square/okhttp/issues/4967 |
| CVE-2016-2402 | Medium | 2017-01-30 | Mitigation candidate | Proof of concept only | OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate. |