WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Product oncommand unified manager core package✕
Overview 8 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
8matches 0in Waratek scope0.0% 0protected0.0% 1exploited12.5% 1CISA KEV12.5% 1public PoC12.5% 2EPSS ≥ 0.525.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 8 100.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 4 50.0% Medium 4 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 8 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 12.5% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 12.5% No public exploit 6 75.0%
split by peak 2 / quarter
Outside Waratek scope: 8 Medium: 4High: 4 not blocked: 8 No public exploit: 6Forecast only: 1Exploited: 1
Q2 172 Outside Waratek scope2 High2 not blocked2 No public exploit2 Q3 170 Q4 171 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 Q1 180 Q2 180 Q3 180 Q4 180 Q1 191 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 Q2 190 Q3 190 Q4 191 Outside Waratek scope1 High1 not blocked1 No public exploit1 Q1 200 Q2 202 Outside Waratek scope2 Medium2 not blocked2 Forecast only1 No public exploit1 Q3 200 Q4 200 Q1 211 Outside Waratek scope1 High1 not blocked1 Exploited1
Q3 17Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-3156 High 2021-01-26 Outside Waratek scope Exploited Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.
CVE-2020-14002 Medium 2020-06-29 Outside Waratek scope No public exploit PuTTY 0.68 through 0.73 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client).
CVE-2020-1927 Medium 2020-04-02 Outside Waratek scope Forecast only In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
CVE-2019-17069 High 2019-10-01 Outside Waratek scope No public exploit PuTTY before 0.73 might allow remote SSH-1 servers to cause a denial of service by accessing freed memory locations via an SSH1_MSG_DISCONNECT message.
CVE-2019-1559 Medium 2019-02-27 Outside Waratek scope No public exploit If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVE-2017-15906 Medium 2017-10-26 Outside Waratek scope No public exploit The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files.
CVE-2017-7439 High 2017-05-26 Outside Waratek scope No public exploit NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 might allow remote attackers to obtain sensitive information via vectors involving error messages.
CVE-2017-7236 High 2017-05-26 Outside Waratek scope No public exploit SQL injection vulnerability in NetApp OnCommand Unified Manager Core Package 5.x before 5.2.2P1 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.