WaratekVRT Sign in

Sap CVEs

11 CVEs, 3 exploited, 6 protected by Waratek

Reset
More filters (1)
Columns
Product sap✕
Overview 11 matches · 5 protected · 3 exploited · 2 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
11matches 5protected45.5% 3exploited27.3% 2CISA KEV18.2% 3public PoC27.3% 3EPSS ≥ 0.527.3%
Protected by Waratek 6 54.5% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 45.5%
Critical 1 9.1% High 2 18.2% Medium 7 63.6% Low 1 9.1% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 45.5% partly blocked 1 9.1% not blocked 5 45.5% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 27.3% Working exploit published 0 0.0% Proof of concept only 2 18.2% Forecast only 0 0.0% No public exploit 6 54.5%
split by peak 3 / year
No exploit published: 5Protected by Waratek: 6 Low: 1Medium: 7High: 2Critical: 1 not blocked: 5partly blocked: 1blocked by ARMR today: 5 No public exploit: 6Proof of concept only: 2Exploited: 3
20132 Protected by Waratek1 No exploit published1 Medium1 Low1 blocked by ARMR today1 not blocked1 No public exploit2 20140 20150 20160 20171 Protected by Waratek1 High1 partly blocked1 Exploited1 20181 No exploit published1 Medium1 not blocked1 No public exploit1 20190 20200 20212 Protected by Waratek1 No exploit published1 Medium2 blocked by ARMR today1 not blocked1 Exploited1 No public exploit1 20223 Protected by Waratek1 No exploit published2 Critical1 Medium2 blocked by ARMR today1 not blocked2 Proof of concept only2 No public exploit1 20230 20241 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20250 20261 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1
2014201620182020202220242026
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-34486 High 2026-04-09 Protected by Waratek Exploited Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.
CVE-2022-47894 Medium 2024-04-09 Protected by Waratek No public exploit Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. For more information, the fix already was merged in the source code but Zeppelin decided to retire the SAP component NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2022-24891 Medium 2022-04-27 No exploit published Proof of concept only ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for a cross-site scripting vulnerability in ESAPI caused by a incorrect regular expression for "onsiteURL" in the **antisamy-esapi.xml** configuration file that can cause "javascript:" URLs to fail to be correctly sanitized. This issue is patched in ESAPI 2.3.0.0. As a workaround, manually edit the **antisamy-esapi.xml** configuration files to change the "onsiteURL" regular expression. More information about remediation of the vulnerability, including the workaround, is available in the maintainers' release notes and security bulletin.
CVE-2022-23457 Critical 2022-04-25 Protected by Waratek Proof of concept only ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, the default implementation of `Validator.getValidDirectoryPath(String, String, File, boolean)` may incorrectly treat the tested input string as a child of the specified parent directory. This potentially could allow control-flow bypass checks to be defeated if an attack can specify the entire string representing the 'input' path. This vulnerability is patched in release 2.3.0.0 of ESAPI. As a workaround, it is possible to write one's own implementation of the Validator interface. However, maintainers do not recommend this.
CVE-2022-23437 Medium 2022-01-24 No exploit published No public exploit There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. This causes, the XercesJ XML parser to wait in an infinite loop, which may sometimes consume system resources for prolonged duration. This vulnerability is present within XercesJ version 2.12.1 and the previous versions.
CVE-2021-45105 Medium 2021-12-18 Protected by Waratek Exploited Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2010-3300 Medium 2021-06-22 No exploit published No public exploit It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.
CVE-2018-8032 Medium 2018-08-02 No exploit published No public exploit Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services.
CVE-2017-12615 High 2017-09-19 Protected by Waratek Exploited When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2013-5960 Medium 2013-09-30 No exploit published No public exploit The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0.1 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against the intended cipher mode in a non-default configuration, a different vulnerability than CVE-2013-5679.
CVE-2013-5679 Low 2013-09-30 Protected by Waratek No public exploit The authenticated-encryption feature in the symmetric-encryption implementation in the OWASP Enterprise Security API (ESAPI) for Java 2.x before 2.1.0 does not properly resist tampering with serialized ciphertext, which makes it easier for remote attackers to bypass intended cryptographic protection mechanisms via an attack against authenticity in the default configuration, involving a null MAC and a zero MAC length.