Overview 33 matches · 10 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
33matches
10in Waratek scope30.3%
1protected3.0%
0exploited0.0%
0CISA KEV0.0%
3public PoC9.1%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
3.0%
Rule in development
0
0.0%
Mitigation candidate
1
3.0%
No exploit published
8
24.2%
Outside Waratek scope
0
0.0%
Not applicable
23
69.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
3.0%
partly blocked
0
0.0%
not blocked
32
97.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
3
9.1%
Proof of concept only
4
12.1%
Forecast only
0
0.0%
No public exploit
26
78.8%
split by
peak 6 / year
20021
Not applicable1
Medium1
not blocked1
No public exploit1
20030
20040
20050
20060
20070
20081
Not applicable1
Medium1
not blocked1
No public exploit1
20090
20101
Not applicable1
Medium1
not blocked1
Working exploit published1
20111
Not applicable1
Medium1
not blocked1
No public exploit1
20121
No exploit published1
Medium1
not blocked1
No public exploit1
20130
20144
Mitigation candidate1
Not applicable3
High1
Medium3
not blocked4
Working exploit published1
No public exploit3
20150
20160
20172
Not applicable2
High2
not blocked2
No public exploit2
20181
Not applicable1
High1
not blocked1
No public exploit1
20193
Not applicable3
High3
not blocked3
Working exploit published1
No public exploit2
20204
No exploit published2
Not applicable2
High2
Medium2
not blocked4
No public exploit4
20216
No exploit published1
Not applicable5
Critical2
High4
not blocked6
Proof of concept only2
No public exploit4
20222
Protected by Waratek1
No exploit published1
Critical1
High1
blocked by ARMR today1
not blocked1
No public exploit2
20230
20241
Not applicable1
High1
not blocked1
No public exploit1
20253
No exploit published2
Not applicable1
Critical1
Medium2
not blocked3
Proof of concept only1
No public exploit2
20262
No exploit published1
Not applicable1
High2
not blocked2
Proof of concept only1
No public exploit1
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-46592 | High | 2026-07-06 | No exploit published | No public exploit | Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component. The camel-cxf producer selects which SOAP operation to invoke on the backend service from the operationName (and operationNamespace) Exchange header, whose constant values (CxfConstants.OPERATION_NAME / OPERATION_NAMESPACE) were the plain strings operationName / operationNamespace. Because these names do not start with the Camel / camel prefix, HttpHeaderFilterStrategy - which blocks only the Camel header namespace on the HTTP boundary - let them pass from an inbound HTTP request straight into the Exchange. In a route that bridges an HTTP consumer (for example platform-http) into a cxf: producer, any HTTP client could therefore set the operationName header and have CxfProducer resolve and invoke a different WSDL operation than the route intended - for example replacing a read operation with a destructive one - against the backend SOAP service (a confused-deputy redirection). The constant is defined in the shared camel-cxf-common module, so the same non-prefixed names also applied to camel-cxfrs. No credentials are required when the bridging consumer is unauthenticated. This issue affects Apache Camel: from 4.0.0 before 4.14.8, from 4.15.0 before 4.18.3, from 4.19.0 before 4.21.0. Users are recommended to upgrade to version 4.21.0, which fixes the issue. If users are on the 4.14.x LTS releases stream, then they are suggested to upgrade to 4.14.8. If users are on the 4.18.x releases stream, then they are suggested to upgrade to 4.18.3. After upgrading, the operation-selection headers are named CamelCxfOperationName / CamelCxfOperationNamespace and are filtered at transport boundaries; see the 4.21 upgrade guide for the cross-transport carrier-header pattern. For deployments that cannot upgrade immediately, do not select the CXF operation from untrusted input: strip the operationName and operationNamespace headers from any untrusted ingress before the cxf: producer and set the operation from a trusted source in the route. |
| CVE-2019-25355 | High | 2026-02-18 | Not applicable | Proof of concept only | gSOAP 2.8 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP path traversal techniques. Attackers can retrieve sensitive files like /etc/passwd by sending crafted GET requests with multiple '../' directory traversal sequences. |
| CVE-2023-53983 | Critical | 2025-12-30 | Not applicable | Proof of concept only | Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms. |
| CVE-2025-53657 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configuration form, increasing the potential for attackers to observe and capture them. |
| CVE-2025-53656 | Medium | 2025-07-09 | No exploit published | No public exploit | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system. |
| CVE-2024-7565 | High | 2024-11-22 | Not applicable | No public exploit | SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of SMARTBEAR SoapUI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the unpackageAll function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19060. |
| CVE-2022-45378 | Critical | 2022-11-14 | No exploit published | No public exploit | In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. |
| CVE-2022-40705 | High | 2022-09-22 | Protected by Waratek | No public exploit | An Improper Restriction of XML External Entity Reference vulnerability in RPCRouterServlet of Apache SOAP allows an attacker to read arbitrary files over HTTP. This issue affects Apache SOAP version 2.2 and later versions. It is unknown whether previous versions are also affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer |
| CVE-2021-21783 | Critical | 2021-03-25 | No exploit published | No public exploit | A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2020-13578 | High | 2021-02-10 | Not applicable | Proof of concept only | A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2020-13577 | High | 2021-02-10 | Not applicable | No public exploit | A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2020-13576 | Critical | 2021-02-10 | Not applicable | No public exploit | A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2020-13575 | High | 2021-02-10 | Not applicable | Proof of concept only | A denial-of-service vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2020-13574 | High | 2021-02-10 | Not applicable | No public exploit | A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability. |
| CVE-2020-2251 | Medium | 2020-09-01 | No exploit published | No public exploit | Jenkins SoapUI Pro Functional Testing Plugin 1.5 and earlier transmits project passwords in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure. |
| CVE-2020-2250 | Medium | 2020-09-01 | No exploit published | No public exploit | Jenkins SoapUI Pro Functional Testing Plugin 1.3 and earlier stores project passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system. |
| CVE-2019-12180 | High | 2020-02-05 | Not applicable | No public exploit | An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code (Java scripting language) on the victim machine by inducing it to open a malicious Project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project. |
| CVE-2012-6302 | High | 2020-01-24 | Not applicable | No public exploit | Soapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed Soapbox. |
| CVE-2012-6071 | High | 2019-11-19 | Not applicable | No public exploit | nuSOAP before 0.7.3-5 does not properly check the hostname of a cert. |
| CVE-2019-6973 | High | 2019-03-21 | Not applicable | Working exploit published | Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server (based on gSOAP 2.8.x) is configured for an iterative queueing approach (aka non-threaded operation) with a timeout of several seconds. |
| CVE-2019-7659 | High | 2019-02-09 | Not applicable | No public exploit | Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers to cause a denial of service (application abort) or possibly have unspecified other impact if a server application is built with the -DWITH_COOKIES flag. This affects the C/C++ libgsoapck/libgsoapck++ and libgsoapssl/libgsoapssl++ libraries, as these are built with that flag. |
| CVE-2017-16670 | High | 2018-02-19 | Not applicable | No public exploit | The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file. |
| CVE-2015-2297 | High | 2017-10-06 | Not applicable | No public exploit | nanohttp in libcsoap allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Authorization header. |
| CVE-2017-9765 | High | 2017-07-20 | Not applicable | No public exploit | Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers. |
| CVE-2014-6724 | Medium | 2014-09-26 | Not applicable | No public exploit | The Soap Making (aka com.tapatalk.soapmakingforumcom) application 3.7.13 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |
| CVE-2014-3243 | Medium | 2014-05-12 | Not applicable | No public exploit | SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted SOAP request containing a large number of nested entity references. |
| CVE-2014-3242 | Medium | 2014-05-12 | Not applicable | No public exploit | SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
| CVE-2014-1202 | High | 2014-01-25 | Mitigation candidate | Working exploit published | The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file. |
| CVE-2012-5784 | Medium | 2012-11-04 | No exploit published | No public exploit | Apache Axis 1.4 and earlier, as used in PayPal Payments Pro, PayPal Mass Pay, PayPal Transactional Information SOAP, the Java Message Service implementation in Apache ActiveMQ, and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. |
| CVE-2011-3761 | Medium | 2011-09-24 | Not applicable | No public exploit | NuSOAP 0.9.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by nuSOAP/classes/class.wsdl.php and certain other files. |
| CVE-2010-3070 | Medium | 2010-09-28 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes. |
| CVE-2008-4965 | Medium | 2008-11-06 | Not applicable | No public exploit | liguidsoap.py in liguidsoap 0.3.8.1+2 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/liguidsoap.liq, (2) /tmp/lig.#####.log, and (3) /tmp/emission.ogg temporary files. |
| CVE-2002-1742 | Medium | 2002-12-31 | Not applicable | No public exploit | SOAP::Lite 0.50 through 0.52 allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger. |