WaratekVRT Sign in
Reset
More filters (1)
Columns
Product studio✕
Overview 14 matches · 1 exploited · 0 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
14matches 1exploited7.1% 0CISA KEV0.0% 2public PoC14.3% 2EPSS ≥ 0.514.3%
Protected by Waratek 14 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 14 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 14 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 7.1% Working exploit published 1 7.1% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 12 85.7%
split by peak 4 / year
Protected by Waratek: 14 High: 14 blocked by ARMR today: 14 No public exploit: 12Working exploit published: 1Exploited: 1
20161 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20170 20181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20204 Protected by Waratek4 High4 blocked by ARMR today4 Working exploit published1 No public exploit3 20212 Protected by Waratek2 High2 blocked by ARMR today2 Exploited1 No public exploit1 20223 Protected by Waratek3 High3 blocked by ARMR today3 No public exploit3 20231 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20240 20251 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
2016201720182019202020212022202320242025
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-10492 High 2025-09-16 Protected by Waratek No public exploit A Java deserialisation vulnerability has been discovered in Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library
CVE-2023-28681 High 2023-04-02 Protected by Waratek No public exploit Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-40634 High 2022-09-13 Protected by Waratek No public exploit Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker SSTI.
CVE-2022-25647 High 2022-05-01 Protected by Waratek No public exploit The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks.
CVE-2022-23181 High 2022-01-27 Protected by Waratek No public exploit The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to 9.0.56 and 8.5.55 to 8.5.73 that allowed a local attacker to perform actions with the privileges of the user that the Tomcat process is using. This issue is only exploitable when Tomcat is configured to persist sessions using the FileStore.
CVE-2021-4104 High 2021-12-14 Protected by Waratek Exploited JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-20218 High 2021-03-16 Protected by Waratek No public exploit A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2
CVE-2017-15685 High 2020-11-27 Protected by Waratek No public exploit Crafter CMS Crafter Studio 3.0.1 is affected by: XML External Entity (XXE). An unauthenticated attacker is able to create a site with specially crafted XML that allows the retrieval of OS files out-of-band.
CVE-2017-15684 High 2020-11-27 Protected by Waratek No public exploit Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system.
CVE-2020-26217 High 2020-11-16 Protected by Waratek Working exploit published XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.
CVE-2020-7712 High 2020-08-30 Protected by Waratek No public exploit This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.
CVE-2019-10086 High 2019-08-20 Protected by Waratek No public exploit In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVE-2018-19907 High 2018-12-06 Protected by Waratek No public exploit A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file (.ftl filetype) that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a web page.
CVE-2015-5349 High 2016-04-11 Protected by Waratek No public exploit The CSV export in Apache LDAP Studio and Apache Directory Studio before 2.0.0-M10 does not properly escape field values, which might allow attackers to execute arbitrary commands by leveraging a crafted LDAP entry that is interpreted as a formula when imported into a spreadsheet.