WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor netapp✕Product trident✕
Overview 14 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
14matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC14.3% 2EPSS ≥ 0.514.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 2 14.3% Not applicable 12 85.7% Withdrawn CVE 0 0.0%
Critical 4 28.6% High 8 57.1% Medium 2 14.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 14 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 7.1% Proof of concept only 1 7.1% Forecast only 1 7.1% No public exploit 11 78.6%
split by peak 5 / quarter
Not applicable: 12Outside Waratek scope: 2 Medium: 2High: 8Critical: 4 not blocked: 14 No public exploit: 11Forecast only: 1Proof of concept only: 1Working exploit published: 1
Q4 181 Not applicable1 Critical1 not blocked1 Working exploit published1 Q1 190 Q2 192 Not applicable2 High1 Medium1 not blocked2 No public exploit2 Q3 191 Outside Waratek scope1 High1 not blocked1 Forecast only1 Q4 190 Q1 200 Q2 200 Q3 200 Q4 205 Not applicable5 Critical3 High2 not blocked5 No public exploit5 Q1 210 Q2 210 Q3 211 Outside Waratek scope1 Medium1 not blocked1 Proof of concept only1 Q4 211 Not applicable1 High1 not blocked1 No public exploit1 Q1 221 Not applicable1 High1 not blocked1 No public exploit1 Q2 221 Not applicable1 High1 not blocked1 No public exploit1 Q3 220 Q4 220 Q1 230 Q2 230 Q3 230 Q4 231 Not applicable1 High1 not blocked1 No public exploit1
Q4 18Q2 19Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-39325 High 2023-10-11 Not applicable No public exploit A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.
CVE-2022-28948 High 2022-05-19 Not applicable No public exploit An issue in the Unmarshal function in Go-Yaml v3 causes the program to crash when attempting to deserialize invalid input.
CVE-2022-24921 High 2022-03-05 Not applicable No public exploit regexp.Compile in Go before 1.16.15 and 1.17.x before 1.17.8 allows stack exhaustion via a deeply nested expression.
CVE-2021-25742 High 2021-10-29 Not applicable No public exploit A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
CVE-2021-34558 Medium 2021-07-15 Outside Waratek scope Proof of concept only The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
CVE-2020-29511 Critical 2020-12-14 Not applicable No public exploit The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
CVE-2020-29510 Critical 2020-12-14 Not applicable No public exploit The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
CVE-2020-29509 Critical 2020-12-14 Not applicable No public exploit The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes during tokenization round-trips, which allows an attacker to craft inputs that behave in conflicting ways during different stages of processing in affected downstream applications.
CVE-2020-28366 High 2020-11-18 Not applicable No public exploit Code injection in the go command with cgo before Go 1.14.12 and Go 1.15.5 allows arbitrary code execution at build time via a malicious unquoted symbol name in a linked object file.
CVE-2020-28362 High 2020-11-18 Not applicable No public exploit Go before 1.14.12 and 1.15.x before 1.15.4 allows Denial of Service.
CVE-2019-9514 High 2019-08-13 Outside Waratek scope Forecast only Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.
CVE-2019-11244 Medium 2019-04-22 Not applicable No public exploit In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.
CVE-2019-11243 High 2019-04-22 Not applicable No public exploit In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig()
CVE-2018-1002105 Critical 2018-12-05 Not applicable Working exploit published In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apiserver allowed specially crafted requests to establish a connection through the Kubernetes API server to backend servers, then send arbitrary requests over the same connection directly to the backend, authenticated with the Kubernetes API server's TLS credentials used to establish the backend connection.