WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product trident✕
Overview 14 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
14matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC14.3% 1EPSS ≥ 0.57.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 14 100.0% Withdrawn CVE 0 0.0%
Critical 4 28.6% High 9 64.3% Medium 1 7.1% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 7.1% Proof of concept only 1 7.1% Forecast only 0 0.0% No public exploit 12 85.7%
split by peak 5 / quarter
Not applicable: 14 Medium: 1High: 9Critical: 4 not blocked: 14 No public exploit: 12Proof of concept only: 1Working exploit published: 1
Q1 181 Not applicable1 High1 not blocked1 No public exploit1 Q2 180 Q3 180 Q4 181 Not applicable1 Critical1 not blocked1 Working exploit published1 Q1 190 Q2 192 Not applicable2 High1 Medium1 not blocked2 No public exploit2 Q3 190 Q4 190 Q1 200 Q2 201 Not applicable1 High1 not blocked1 Proof of concept only1 Q3 200 Q4 205 Not applicable5 Critical3 High2 not blocked5 No public exploit5 Q1 210 Q2 210 Q3 210 Q4 211 Not applicable1 High1 not blocked1 No public exploit1 Q1 221 Not applicable1 High1 not blocked1 No public exploit1 Q2 221 Not applicable1 High1 not blocked1 No public exploit1 Q3 220 Q4 220 Q1 230 Q2 230 Q3 230 Q4 231 Not applicable1 High1 not blocked1 No public exploit1
Q2 18Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-39325 High 2023-10-11 Not applicable No public exploit A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
CVE-2022-28948 High 2022-05-19 Not applicable No public exploit An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
CVE-2022-24921 High 2022-03-05 Not applicable No public exploit regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVE-2021-25742 High 2021-10-29 Not applicable No public exploit A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
CVE-2020-29511 Critical 2020-12-14 Not applicable No public exploit The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
CVE-2020-29510 Critical 2020-12-14 Not applicable No public exploit The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
CVE-2020-29509 Critical 2020-12-14 Not applicable No public exploit The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
CVE-2020-28366 High 2020-11-18 Not applicable No public exploit Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
CVE-2020-28362 High 2020-11-18 Not applicable No public exploit Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
CVE-2020-12446 High 2020-04-29 Not applicable Proof of concept only The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writing to Model Specific Register (MSR) registers, and input from and output to I/O ports to local non-privileged users. This leads to privilege escalation to NT AUTHORITY\SYSTEM.
CVE-2019-11244 Medium 2019-04-22 Not applicable No public exploit In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
CVE-2019-11243 High 2019-04-22 Not applicable No public exploit In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()
CVE-2018-1002105 Critical 2018-12-05 Not applicable Working exploit published In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.
CVE-2018-1000133 High 2018-03-16 Not applicable No public exploit Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to login, and could edit their profile and set the "System Administrator" permission to "yes" on themselves.. This vulnerability appears to have been fixed in 1.4.6 RC2.