WaratekVRT Sign in
Reset
More filters (2)
Columns
Vendor oracle✕Product virtualization✕
Overview 7 matches · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
7matches 0exploited0.0% 0CISA KEV0.0% 1public PoC14.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 7 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 6 85.7% High 1 14.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 7 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 14.3% Forecast only 0 0.0% No public exploit 6 85.7%
split by peak 4 / quarter
Protected by Waratek: 7 High: 1Critical: 6 blocked by ARMR today: 7 No public exploit: 6Proof of concept only: 1
Q1 182 Protected by Waratek2 Critical2 blocked by ARMR today2 Proof of concept only1 No public exploit1 Q2 180 Q3 180 Q4 180 Q1 194 Protected by Waratek4 Critical4 blocked by ARMR today4 No public exploit4 Q2 190 Q3 191 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Q1 18Q2 18Q3 18Q4 18Q1 19Q2 19Q3 19
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-10086 High 2019-08-20 Protected by Waratek No public exploit In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.
CVE-2018-14721 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.
CVE-2018-14720 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.
CVE-2018-14719 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.
CVE-2018-14718 Critical 2019-01-02 Protected by Waratek No public exploit FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.
CVE-2017-7525 Critical 2018-02-06 Protected by Waratek Proof of concept only A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVE-2017-15095 Critical 2018-02-06 Protected by Waratek No public exploit A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.