WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product soap✕
Overview 23 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
23matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC8.7% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 23 100.0% Withdrawn CVE 0 0.0%
Critical 2 8.7% High 14 60.9% Medium 7 30.4% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 23 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 8.7% Proof of concept only 4 17.4% Forecast only 0 0.0% No public exploit 17 73.9%
split by peak 5 / year
Not applicable: 23 Medium: 7High: 14Critical: 2 not blocked: 23 No public exploit: 17Proof of concept only: 4Working exploit published: 2
20021 Not applicable1 Medium1 not blocked1 No public exploit1 20030 20040 20050 20060 20070 20081 Not applicable1 Medium1 not blocked1 No public exploit1 20090 20101 Not applicable1 Medium1 not blocked1 Working exploit published1 20111 Not applicable1 Medium1 not blocked1 No public exploit1 20120 20130 20143 Not applicable3 Medium3 not blocked3 No public exploit3 20150 20160 20172 Not applicable2 High2 not blocked2 No public exploit2 20181 Not applicable1 High1 not blocked1 No public exploit1 20193 Not applicable3 High3 not blocked3 Working exploit published1 No public exploit2 20202 Not applicable2 High2 not blocked2 No public exploit2 20215 Not applicable5 Critical1 High4 not blocked5 Proof of concept only2 No public exploit3 20220 20230 20241 Not applicable1 High1 not blocked1 No public exploit1 20251 Not applicable1 Critical1 not blocked1 Proof of concept only1 20261 Not applicable1 High1 not blocked1 Proof of concept only1
2002200420062008201020122014201620182020202220242026
23 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-25355 High 2026-02-18 Not applicable Proof of concept only gSOAP 2.8 contains a directory traversal vulnerability that allows unauthenticated attackers to access system files by manipulating HTTP path traversal techniques. Attackers can retrieve sensitive files like /etc/passwd by sending crafted GET requests with multiple '../' directory traversal sequences.
CVE-2023-53983 Critical 2025-12-30 Not applicable Proof of concept only Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.
CVE-2024-7565 High 2024-11-22 Not applicable No public exploit SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of SMARTBEAR SoapUI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the unpackageAll function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19060.
CVE-2020-13578 High 2021-02-10 Not applicable Proof of concept only A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2020-13577 High 2021-02-10 Not applicable No public exploit A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2020-13576 Critical 2021-02-10 Not applicable No public exploit A code execution vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2020-13575 High 2021-02-10 Not applicable Proof of concept only A denial-of-service vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2020-13574 High 2021-02-10 Not applicable No public exploit A denial-of-service vulnerability exists in the WS-Security plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2019-12180 High 2020-02-05 Not applicable No public exploit An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code (Java scripting language) on the victim machine by inducing it to open a malicious Project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project.
CVE-2012-6302 High 2020-01-24 Not applicable No public exploit Soapbox through 0.3.1: Sandbox bypass - runs a second instance of Soapbox within a sandboxed Soapbox.
CVE-2012-6071 High 2019-11-19 Not applicable No public exploit nuSOAP before 0.7.3-5 does not properly check the hostname of a cert.
CVE-2019-6973 High 2019-03-21 Not applicable Working exploit published Sricam IP CCTV cameras are vulnerable to denial of service via multiple incomplete HTTP requests because the web server (based on gSOAP 2.8.x) is configured for an iterative queueing approach (aka non-threaded operation) with a timeout of several seconds.
CVE-2019-7659 High 2019-02-09 Not applicable No public exploit Genivia gSOAP 2.7.x and 2.8.x before 2.8.75 allows attackers to cause a denial of service (application abort) or possibly have unspecified other impact if a server application is built with the -DWITH_COOKIES flag. This affects the C/C++ libgsoapck/libgsoapck++ and libgsoapssl/libgsoapssl++ libraries, as these are built with that flag.
CVE-2017-16670 High 2018-02-19 Not applicable No public exploit The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file.
CVE-2015-2297 High 2017-10-06 Not applicable No public exploit nanohttp in libcsoap allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted Authorization header.
CVE-2017-9765 High 2017-07-20 Not applicable No public exploit Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, as used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow and application crash) via a large XML document, aka Devil's Ivy. NOTE: the large document would be blocked by many common web-server configurations on general-purpose computers.
CVE-2014-6724 Medium 2014-09-26 Not applicable No public exploit The Soap Making (aka com.tapatalk.soapmakingforumcom) application 3.7.13 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
CVE-2014-3243 Medium 2014-05-12 Not applicable No public exploit SOAPpy 0.12.5 does not properly detect recursion during entity expansion, which allows remote attackers to cause a denial of service (memory and CPU consumption) via a crafted SOAP request containing a large number of nested entity references.
CVE-2014-3242 Medium 2014-05-12 Not applicable No public exploit SOAPpy 0.12.5 allows remote attackers to read arbitrary files via a SOAP request containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
CVE-2011-3761 Medium 2011-09-24 Not applicable No public exploit NuSOAP 0.9.5 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by nuSOAP/classes/class.wsdl.php and certain other files.
CVE-2010-3070 Medium 2010-09-28 Not applicable Working exploit published Cross-site scripting (XSS) vulnerability in NuSOAP 0.9.5, as used in MantisBT and other products, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to an arbitrary PHP script that uses NuSOAP classes.
CVE-2008-4965 Medium 2008-11-06 Not applicable No public exploit liguidsoap.py in liguidsoap 0.3.8.1+2 allows local users to overwrite arbitrary files via a symlink attack on (1) /tmp/liguidsoap.liq, (2) /tmp/lig.#####.log, and (3) /tmp/emission.ogg temporary files.
CVE-2002-1742 Medium 2002-12-31 Not applicable No public exploit SOAP::Lite 0.50 through 0.52 allows remote attackers to load arbitrary Perl functions by suppling a non-existent function in a script using a SOAP::Lite module, which causes the AUTOLOAD subroutine to trigger.