WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product trident✕
Overview 10 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
10matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC10.0% 1EPSS ≥ 0.510.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 10.0% Not applicable 9 90.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 10 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 10 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 10.0% Forecast only 1 10.0% No public exploit 8 80.0%
split by peak 2 / quarter
Not applicable: 9Outside Waratek scope: 1 High: 10 not blocked: 10 No public exploit: 8Forecast only: 1Proof of concept only: 1
Q1 181 Not applicable1 High1 not blocked1 No public exploit1 Q2 180 Q3 180 Q4 180 Q1 190 Q2 191 Not applicable1 High1 not blocked1 No public exploit1 Q3 191 Outside Waratek scope1 High1 not blocked1 Forecast only1 Q4 190 Q1 200 Q2 201 Not applicable1 High1 not blocked1 Proof of concept only1 Q3 200 Q4 202 Not applicable2 High2 not blocked2 No public exploit2 Q1 210 Q2 210 Q3 210 Q4 211 Not applicable1 High1 not blocked1 No public exploit1 Q1 221 Not applicable1 High1 not blocked1 No public exploit1 Q2 221 Not applicable1 High1 not blocked1 No public exploit1 Q3 220 Q4 220 Q1 230 Q2 230 Q3 230 Q4 231 Not applicable1 High1 not blocked1 No public exploit1
Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-39325 High 2023-10-11 Not applicable No public exploit A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
CVE-2022-28948 High 2022-05-19 Not applicable No public exploit An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
CVE-2022-24921 High 2022-03-05 Not applicable No public exploit regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVE-2021-25742 High 2021-10-29 Not applicable No public exploit A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
CVE-2020-28366 High 2020-11-18 Not applicable No public exploit Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
CVE-2020-28362 High 2020-11-18 Not applicable No public exploit Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
CVE-2020-12446 High 2020-04-29 Not applicable Proof of concept only The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writing to Model Specific Register (MSR) registers, and input from and output to I/O ports to local non-privileged users. This leads to privilege escalation to NT AUTHORITY\SYSTEM.
CVE-2019-9514 High 2019-08-13 Outside Waratek scope Forecast only Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
CVE-2019-11243 High 2019-04-22 Not applicable No public exploit In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()
CVE-2018-1000133 High 2018-03-16 Not applicable No public exploit Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to login, and could edit their profile and set the "System Administrator" permission to "yes" on themselves.. This vulnerability appears to have been fixed in 1.4.6 RC2.