WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product proxygen✕
Overview 7 matches · 1 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
7matches 1in Waratek scope14.3% 0protected0.0% 1exploited14.3% 1CISA KEV14.3% 1public PoC14.3% 1EPSS ≥ 0.514.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 14.3% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 6 85.7% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 7 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 85.7%
split by peak 3 / year
Not applicable: 6Mitigation candidate: 1 High: 7 not blocked: 7 No public exploit: 6Exploited: 1
20172 Not applicable2 High2 not blocked2 No public exploit2 20183 Not applicable3 High3 not blocked3 No public exploit3 20190 20200 20211 Not applicable1 High1 not blocked1 No public exploit1 20220 20231 Mitigation candidate1 High1 not blocked1 Exploited1
2017201820192020202120222023
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-44487 High 2023-10-10 Mitigation candidate Exploited The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2021-24029 High 2021-03-15 Not applicable No public exploit A packet of death scenario is possible in mvfst via a specially crafted message during a QUIC session, which causes a crash via a failed assertion. Per QUIC specification, this particular message should be treated as a connection error. This issue affects mvfst versions prior to commit a67083ff4b8dcbb7ee2839da6338032030d712b0 and proxygen versions prior to v2021.03.15.00.
CVE-2018-6347 High 2018-12-31 Not applicable No public exploit An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior to v2018.12.31.00.
CVE-2018-6346 High 2018-12-31 Not applicable No public exploit A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This affects Proxygen prior to v2018.12.31.00.
CVE-2018-6343 High 2018-12-31 Not applicable No public exploit Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsing a Certificate/CertificateRequest HTTP2 Frame over a fizz (TLS 1.3) transport. This issue affects Proxygen releases starting from v2018.10.29.00 until the fix in v2018.11.19.00.
CVE-2015-7265 High 2017-04-10 Not applicable No public exploit Facebook Proxygen before 2015-11-09 mismanages HTTPMessage.request state, which allows remote attackers to conduct hijacking attacks and bypass ACL checks.
CVE-2015-7263 High 2017-04-10 Not applicable No public exploit The SPDY/2 codec in Facebook Proxygen before 2015-11-09 allows remote attackers to conduct hijacking attacks and bypass ACL checks via a crafted host value.