WaratekVRT Sign in

Critical Retail Predictive Application Server CVEs

3 CVEs, 3 protected by Waratek

Reset
More filters (1)
Columns
Product retail predictive application server✕
Overview 3 matches · 0 exploited · 0 CISA KEV · 2 public PoC
3matches 0exploited0.0% 0CISA KEV0.0% 2public PoC66.7%
Protected by Waratek 3 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 3 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 3 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 33.3% Proof of concept only 1 33.3% Forecast only 1 33.3% No public exploit 0 0.0%
split by peak 2 / month
Protected by Waratek: 3 Critical: 3 blocked by ARMR today: 3 Forecast only: 1Proof of concept only: 1Working exploit published: 1
Apr 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 May 170 Jun 170 Jul 170 Aug 170 Sep 170 Oct 170 Nov 170 Dec 170 Jan 180 Feb 180 Mar 180 Apr 182 Protected by Waratek2 Critical2 blocked by ARMR today2 Proof of concept only1 Forecast only1
Apr 17Jun 17Aug 17Oct 17Dec 17Feb 18Apr 18
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2018-1275 Critical 2018-04-11 Protected by Waratek Forecast only Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.
CVE-2018-1270 Critical 2018-04-06 Protected by Waratek Proof of concept only Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions, allow applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.
CVE-2017-5645 Critical 2017-04-17 Protected by Waratek Working exploit published In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.