WaratekVRT Sign in
Reset
More filters (1)
Columns
Product utilities framework✕
Overview 5 matches · 2 exploited · 1 CISA KEV · 2 public PoC · 3 EPSS ≥ 0.5
5matches 2exploited40.0% 1CISA KEV20.0% 2public PoC40.0% 3EPSS ≥ 0.560.0%
Protected by Waratek 5 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 5 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 40.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 20.0% No public exploit 2 40.0%
split by peak 1 / quarter
Protected by Waratek: 5 Critical: 5 blocked by ARMR today: 5 No public exploit: 2Forecast only: 1Exploited: 2
Q1 181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 180 Q3 180 Q4 180 Q1 190 Q2 190 Q3 191 Protected by Waratek1 Critical1 blocked by ARMR today1 Forecast only1 Q4 190 Q1 201 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q2 201 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q3 200 Q4 200 Q1 211 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1
Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-14756 Critical 2021-01-20 Protected by Waratek Exploited Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core Components). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2020-10683 Critical 2020-05-01 Protected by Waratek No public exploit dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE attacks. However, there is popular external documentation from OWASP showing how to enable the safe, non-default behavior in any application that uses dom4j.
CVE-2020-2555 Critical 2020-01-15 Protected by Waratek Exploited Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2019-10173 Critical 2019-07-23 Protected by Waratek Forecast only It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. e.g. JSON. (regression of CVE-2013-7285)
CVE-2018-8088 Critical 2018-03-20 Protected by Waratek No public exploit org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.