WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Product selenium✕
Overview 17 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
17matches 2in Waratek scope11.8% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC11.8% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 5.9% No exploit published 1 5.9% Outside Waratek scope 0 0.0% Not applicable 15 88.2% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 14 82.4% Medium 3 17.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 17 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 11.8% Proof of concept only 2 11.8% Forecast only 0 0.0% No public exploit 13 76.5%
split by peak 9 / year
Not applicable: 15No exploit published: 1Mitigation candidate: 1 Medium: 3High: 14 not blocked: 17 No public exploit: 13Proof of concept only: 2Working exploit published: 2
20063 Not applicable3 High1 Medium2 not blocked3 Working exploit published1 No public exploit2 20070 20080 20090 20100 20110 20120 20130 20140 20150 20160 20170 20189 Not applicable9 High9 not blocked9 No public exploit9 20190 20201 No exploit published1 High1 not blocked1 No public exploit1 20210 20222 Mitigation candidate1 Not applicable1 High2 not blocked2 Working exploit published1 No public exploit1 20232 Not applicable2 High1 Medium1 not blocked2 Proof of concept only2
200720092011201320152017201920212023
17 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-5590 High 2023-10-15 Not applicable Proof of concept only NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.0.
CVE-2020-23452 Medium 2023-07-05 Not applicable Proof of concept only A cross-site scripting (XSS) vulnerability in Selenium Grid v3.141.59 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the hub parameter under the /grid/console page.
CVE-2022-28108 High 2022-04-19 Mitigation candidate Working exploit published Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
CVE-2022-28109 High 2022-04-15 Not applicable No public exploit Selenium Selenium Grid (formerly Selenium Standalone Server) Fixed in 4.0.0-alpha-7 is affected by: DNS rebinding. The impact is: execute arbitrary code (remote). The component is: WebDriver endpoint of Selenium Grid / Selenium Standalone Server. The attack vector is: Triggered by browsing to to a malicious remote web server. The WebDriver endpoint of Selenium Server (Grid) is vulnerable to DNS rebinding. This can be used to execute arbitrary code on the machine.
CVE-2020-2196 High 2020-06-03 No exploit published No public exploit Jenkins Selenium Plugin 3.141.59 and earlier has no CSRF protection for its HTTP endpoints, allowing attackers to perform all administrative actions provided by the plugin.
CVE-2016-10691 High 2018-06-04 Not applicable No public exploit windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVE-2016-10687 High 2018-06-04 Not applicable No public exploit windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVE-2016-10670 High 2018-06-04 Not applicable No public exploit windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVE-2016-10667 High 2018-06-04 Not applicable No public exploit selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVE-2016-10628 High 2018-06-01 Not applicable No public exploit selenium-wrapper is a selenium server wrapper, including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVE-2016-10624 High 2018-06-01 Not applicable No public exploit selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVE-2016-10679 High 2018-05-29 Not applicable No public exploit selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.
CVE-2016-10589 High 2018-05-29 Not applicable No public exploit selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVE-2016-10559 High 2018-05-29 Not applicable No public exploit selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.
CVE-2006-6124 Medium 2006-11-26 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in SeleniumServer Web Server 1.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CVE-2006-5982 High 2006-11-20 Not applicable No public exploit SeleniumServer FTP Server 1.0, and possibly earlier, stores user passwords in plaintext in the Servers directory, which allows attackers to obtain passwords by reading the file. NOTE: the provenance of this information is unknown; details are obtained from third party sources.
CVE-2006-5981 Medium 2006-11-20 Not applicable No public exploit Multiple directory traversal vulnerabilities in SeleniumServer FTP Server 1.0, and possibly earlier, allow remote attackers to list arbitrary directories, read arbitrary files, and upload arbitrary files via directory traversal sequences in the (1) DIR (LIST or NLST), (2) GET (RETR), and (3) PUT (STOR) commands.