WaratekVRT Sign in
Reset
More filters (1)
Columns
Product virtualization✕
Overview 8 matches · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
8matches 1exploited12.5% 0CISA KEV0.0% 2public PoC25.0% 1EPSS ≥ 0.512.5%
Protected by Waratek 8 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 8 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 8 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 12.5% Working exploit published 0 0.0% Proof of concept only 1 12.5% Forecast only 0 0.0% No public exploit 6 75.0%
split by peak 4 / month
Protected by Waratek: 8 Critical: 8 blocked by ARMR today: 8 No public exploit: 6Proof of concept only: 1Exploited: 1
Nov 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Dec 170 Jan 180 Feb 182 Protected by Waratek2 Critical2 blocked by ARMR today2 Proof of concept only1 No public exploit1 Mar 181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Apr 180 May 180 Jun 180 Jul 180 Aug 180 Sep 180 Oct 180 Nov 180 Dec 180 Jan 194 Protected by Waratek4 Critical4 blocked by ARMR today4 No public exploit4
Nov 17Jan 18Mar 18May 18Jul 18Sep 18Nov 18Jan 19
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2018-14721 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
CVE-2018-14720 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVE-2018-14719 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVE-2018-14718 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2018-8088 Critical 2018-03-20 Protected by Waratek No public exploit org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
CVE-2017-7525 Critical 2018-02-06 Protected by Waratek Proof of concept only A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVE-2017-15095 Critical 2018-02-06 Protected by Waratek No public exploit A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.
CVE-2015-7501 Critical 2017-11-09 Protected by Waratek Exploited Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.