WaratekVRT Sign in

Medium Report Manager CVEs

15 CVEs, 1 exploited, 1 protected by Waratek

Reset
More filters (1)
Columns
Product report manager✕
Overview 15 matches · 1 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 3 EPSS ≥ 0.5
15matches 1protected6.7% 1exploited6.7% 0CISA KEV0.0% 1public PoC6.7% 3EPSS ≥ 0.520.0%
Protected by Waratek 1 6.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 14 93.3%
Critical 0 0.0% High 0 0.0% Medium 15 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 6.7% partly blocked 0 0.0% not blocked 14 93.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 6.7% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 2 13.3% No public exploit 12 80.0%
split by peak 5 / year
No exploit published: 14Protected by Waratek: 1 Medium: 15 not blocked: 14blocked by ARMR today: 1 No public exploit: 12Forecast only: 2Exploited: 1
20081 No exploit published1 Medium1 not blocked1 No public exploit1 20090 20100 20110 20120 20130 20140 20150 20162 No exploit published2 Medium2 not blocked2 No public exploit2 20170 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20192 No exploit published2 Medium2 not blocked2 No public exploit2 20203 No exploit published3 Medium3 not blocked3 No public exploit3 20215 Protected by Waratek1 No exploit published4 Medium5 blocked by ARMR today1 not blocked4 Exploited1 Forecast only2 No public exploit2 20221 No exploit published1 Medium1 not blocked1 No public exploit1
20082010201220142016201820202022
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-23437 Medium 2022-01-24 No exploit published No public exploit There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
CVE-2021-45105 Medium 2021-12-18 Protected by Waratek Exploited Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2021-33037 Medium 2021-07-12 No exploit published Forecast only Apache Tomcat 10.0.0-M1 to 10.0.6, 9.0.0.M1 to 9.0.46 and 8.5.0 to 8.5.66 did not correctly parse the HTTP transfer-encoding request header in some circumstances leading to the possibility to request smuggling when used with a reverse proxy. Specifically: - Tomcat incorrectly ignored the transfer encoding header if the client declared it would only accept an HTTP/1.0 response; - Tomcat honoured the identify encoding; and - Tomcat did not ensure that, if present, the chunked encoding was the final encoding.
CVE-2021-27906 Medium 2021-03-19 No exploit published No public exploit A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVE-2021-27807 Medium 2021-03-19 No exploit published No public exploit A carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.22 and prior 2.0.x versions.
CVE-2020-13947 Medium 2021-02-08 No exploit published Forecast only An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.
CVE-2020-5421 Medium 2020-09-19 No exploit published No public exploit In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5.0.18, 4.3.0 - 4.3.28, and older unsupported versions, the protections against RFD attacks from CVE-2015-5211 may be bypassed depending on the browser used through the use of a jsessionid path parameter.
CVE-2020-1941 Medium 2020-05-14 No exploit published No public exploit In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue.
CVE-2020-1954 Medium 2020-04-01 No exploit published No public exploit Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.
CVE-2019-10247 Medium 2019-04-22 No exploit published No public exploit In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.
CVE-2019-10246 Medium 2019-04-22 No exploit published No public exploit In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.
CVE-2018-8032 Medium 2018-08-02 No exploit published No public exploit Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVE-2016-0580 Medium 2016-01-21 No exploit published No public exploit Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect availability via unknown vectors.
CVE-2016-0539 Medium 2016-01-21 No exploit published No public exploit Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 11.5.10.2, 12.1.3, 12.2.3, and 12.2.4 allows remote attackers to affect confidentiality via unknown vectors.
CVE-2008-2585 Medium 2008-07-15 No exploit published No public exploit Unspecified vulnerability in the Oracle Report Manager component in Oracle E-Business Suite 12.0.4 has unknown impact and remote authenticated attack vectors.