WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2017-07-01✕Product oncommand api services✕
Overview 9 matches · 3 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
9matches 3protected33.3% 0exploited0.0% 0CISA KEV0.0% 2public PoC22.2% 0EPSS ≥ 0.50.0%
Protected by Waratek 3 33.3% Rule in development 0 0.0% Mitigation candidate 1 11.1% No exploit published 5 55.6%
Critical 9 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 33.3% partly blocked 0 0.0% not blocked 6 66.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 2 22.2% Forecast only 0 0.0% No public exploit 7 77.8%
split by peak 3 / month
No exploit published: 5Mitigation candidate: 1Protected by Waratek: 3 Critical: 9 not blocked: 6blocked by ARMR today: 3 No public exploit: 7Proof of concept only: 2
Sep 192 Protected by Waratek2 Critical2 blocked by ARMR today2 Proof of concept only1 No public exploit1 Oct 193 No exploit published3 Critical3 not blocked3 No public exploit3 Nov 190 Dec 190 Jan 201 No exploit published1 Critical1 not blocked1 No public exploit1 Feb 201 Mitigation candidate1 Critical1 not blocked1 Proof of concept only1 Mar 201 No exploit published1 Critical1 not blocked1 No public exploit1 Apr 200 May 201 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1
Sep 19Oct 19Nov 19Dec 19Jan 20Feb 20Mar 20Apr 20May 20
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-10683 Critical 2020-05-01 Protected by Waratek No public exploit dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
CVE-2019-14893 Critical 2020-03-02 No exploit published No public exploit A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.
CVE-2020-8840 Critical 2020-02-10 Mitigation candidate Proof of concept only FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
CVE-2019-20330 Critical 2020-01-03 No exploit published No public exploit FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
CVE-2019-17267 Critical 2019-10-07 No exploit published No public exploit A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.
CVE-2019-16943 Critical 2019-10-01 No exploit published No public exploit A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.
CVE-2019-16942 Critical 2019-10-01 No exploit published No public exploit A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.
CVE-2019-16335 Critical 2019-09-15 Protected by Waratek No public exploit A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVE-2019-14540 Critical 2019-09-15 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.