WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product system manager✕
Overview 21 matches · 6 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 5 public PoC · 3 EPSS ≥ 0.5
21matches 6in Waratek scope28.6% 0protected0.0% 1exploited4.8% 0CISA KEV0.0% 5public PoC23.8% 3EPSS ≥ 0.514.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 9.5% No exploit published 4 19.0% Outside Waratek scope 4 19.0% Not applicable 11 52.4% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 21 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 21 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 4.8% Working exploit published 3 14.3% Proof of concept only 1 4.8% Forecast only 1 4.8% No public exploit 15 71.4%
split by peak 6 / year
Not applicable: 11Outside Waratek scope: 4No exploit published: 4Mitigation candidate: 2 High: 21 not blocked: 21 No public exploit: 15Forecast only: 1Proof of concept only: 1Working exploit published: 3Exploited: 1
20091 Not applicable1 High1 not blocked1 No public exploit1 20103 Not applicable3 High3 not blocked3 Working exploit published1 No public exploit2 20110 20120 20130 20140 20150 20160 20173 Outside Waratek scope2 Not applicable1 High3 not blocked3 Working exploit published1 No public exploit2 20181 No exploit published1 High1 not blocked1 No public exploit1 20193 No exploit published1 Not applicable2 High3 not blocked3 No public exploit3 20206 Mitigation candidate2 No exploit published2 Outside Waratek scope2 High6 not blocked6 Working exploit published1 Proof of concept only1 Forecast only1 No public exploit3 20212 Not applicable2 High2 not blocked2 Exploited1 No public exploit1 20221 Not applicable1 High1 not blocked1 No public exploit1 20230 20241 Not applicable1 High1 not blocked1 No public exploit1
20102012201420162018202020222024
21 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-5957 High 2024-09-05 Not applicable No public exploit This vulnerability allows unauthenticated remote attackers to bypass authentication and gain APIs access of the Manager.
CVE-2022-3340 High 2022-11-04 Not applicable No public exploit XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved XML configuration file to be imported.
CVE-2021-27005 High 2021-11-01 Not applicable No public exploit Clustered Data ONTAP versions 9.6 and higher prior to 9.6P16, 9.7P16, 9.8P7 and 9.9.1P3 are susceptible to a vulnerability which could allow a remote attacker to cause a crash of the httpd server.
CVE-2021-23337 High 2021-02-15 Not applicable Exploited Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
CVE-2020-17527 High 2020-12-03 No exploit published No public exploit While investigating bug 64830 it was discovered that Apache Tomcat 10.0.0-M1 to 10.0.0-M9, 9.0.0-M1 to 9.0.39 and 8.5.0 to 8.5.59 could re-use an HTTP request header value from the previous stream received on an HTTP/2 connection for the request associated with the subsequent stream. While this would most likely lead to an error and the closure of the HTTP/2 connection, it is possible that information could leak between requests.
CVE-2020-13935 High 2020-07-14 Mitigation candidate Working exploit published The payload length in a WebSocket frame was not correctly validated in Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M1 to 9.0.36, 8.5.0 to 8.5.56 and 7.0.27 to 7.0.104. Invalid payload lengths could trigger an infinite loop. Multiple requests with invalid payload lengths could lead to a denial of service.
CVE-2020-13934 High 2020-07-14 No exploit published Forecast only An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did not release the HTTP/1.1 processor after the upgrade to HTTP/2. If a sufficient number of such requests were made, an OutOfMemoryException could occur leading to a denial of service.
CVE-2020-11996 High 2020-06-26 Mitigation candidate Proof of concept only A specially crafted sequence of HTTP/2 requests sent to Apache Tomcat 10.0.0-M1 to 10.0.0-M5, 9.0.0.M1 to 9.0.35 and 8.5.0 to 8.5.55 could trigger high CPU usage for several seconds. If a sufficient number of such requests were made on concurrent HTTP/2 connections, the server could become unresponsive.
CVE-2013-3322 High 2020-01-31 Outside Waratek scope No public exploit NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to inject arbitrary commands in the Halt/Reboot interface.
CVE-2013-3321 High 2020-01-29 Outside Waratek scope No public exploit NetApp OnCommand System Manager 2.1 and earlier allows remote attackers to include arbitrary files through specially crafted requests to the "diagnostic" page using the SnapMirror log path parameter.
CVE-2019-12418 High 2019-12-23 No exploit published No public exploit When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.
CVE-2016-5285 High 2019-11-15 Not applicable No public exploit A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote malicious user cause a Denial of Service.
CVE-2019-7588 High 2019-06-18 Not applicable No public exploit A vulnerability in the exacqVision Enterprise System Manager (ESM) v5.12.2 application whereby unauthorized privilege escalation can potentially be achieved. This vulnerability impacts exacqVision ESM v5.12.2 and all prior versions of ESM running on a Windows operating system. This issue does not impact any Windows Server OSs, or Linux deployments with permissions that are not inherited from the root directory. Authorized Users have ‘modify’ permission to the ESM folders, which allows a low privilege account to modify files located in these directories. An executable can be renamed and replaced by a malicious file that could connect back to a bad actor providing system level privileges. A low privileged user is not able to restart the service, but a restart of the system would trigger the execution of the malicious file. This issue affects: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) Version 5.12.2 and prior versions; This issue does not affect: Exacq Technologies, Inc. exacqVision Enterprise System Manager (ESM) 19.03 and above.
CVE-2018-12538 High 2018-06-22 No exploit published No public exploit In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.
CVE-2017-12243 High 2017-11-02 Not applicable Working exploit published A vulnerability in the Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series Next-Generation Firewall (NGFW), and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to obtain root shell privileges on the device, aka Command Injection. The vulnerability is due to improper validation of string input in the shell application. An attacker could exploit this vulnerability through the use of malicious commands. A successful exploit could allow the attacker to obtain root shell privileges on the device. Cisco Bug IDs: CSCvf20741, CSCvf60078.
CVE-2016-5045 High 2017-07-03 Outside Waratek scope No public exploit NetApp OnCommand System Manager before 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering setup.
CVE-2016-3063 High 2017-02-07 Outside Waratek scope No public exploit Multiple functions in NetApp OnCommand System Manager before 8.3.2 do not properly escape special characters, which allows remote authenticated users to execute arbitrary API calls via unspecified vectors.
CVE-2010-2943 High 2010-09-30 Not applicable Working exploit published The xfs implementation in the Linux kernel before 2.6.35 does not look up inode allocation btrees before reading inode buffers, which allows remote authenticated users to read unlinked files, or read or overwrite disk blocks that are currently assigned to an active file but were previously assigned to an unlinked file, by accessing a stale NFS filehandle.
CVE-2010-2798 High 2010-09-08 Not applicable No public exploit The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries, which allows local users to cause a denial of service (NULL pointer dereference and panic) and possibly have unspecified other impact by renaming a file in a GFS2 filesystem, related to the gfs2_rename function in fs/gfs2/ops_inode.c.
CVE-2010-2492 High 2010-09-08 Not applicable No public exploit Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs subsystem in the Linux kernel before 2.6.35 might allow local users to gain privileges or cause a denial of service (system crash) via unspecified vectors.
CVE-2009-3939 High 2009-11-16 Not applicable No public exploit The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the driver by modifying this file.