WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: Full✕Product stream analytics✕
Overview 7 matches · 2 exploited · 0 CISA KEV · 4 public PoC · 2 EPSS ≥ 0.5
7matches 2exploited28.6% 0CISA KEV0.0% 4public PoC57.1% 2EPSS ≥ 0.528.6%
Protected by Waratek 7 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 4 57.1% High 2 28.6% Medium 1 14.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 7 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 28.6% Working exploit published 0 0.0% Proof of concept only 2 28.6% Forecast only 0 0.0% No public exploit 3 42.9%
split by peak 4 / quarter
Protected by Waratek: 7 Medium: 1High: 2Critical: 4 blocked by ARMR today: 7 No public exploit: 3Proof of concept only: 2Exploited: 2
Q1 181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 194 Protected by Waratek4 Critical3 High1 blocked by ARMR today4 Proof of concept only2 No public exploit2 Q4 190 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 211 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 Q4 211 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1
Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-4104 High 2021-12-14 Protected by Waratek Exploited JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-34429 Medium 2021-07-15 Protected by Waratek Exploited For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.
CVE-2019-16335 Critical 2019-09-15 Protected by Waratek No public exploit A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.
CVE-2019-14540 Critical 2019-09-15 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.
CVE-2019-14439 High 2019-07-30 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2019-14379 Critical 2019-07-29 Protected by Waratek No public exploit SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.
CVE-2018-8088 Critical 2018-03-20 Protected by Waratek No public exploit org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.