WaratekVRT Sign in
Reset
More filters (2)
Columns
Vendor redhat✕Product virtualization✕
Overview 10 matches · 2 exploited · 0 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
10matches 2exploited20.0% 0CISA KEV0.0% 3public PoC30.0% 2EPSS ≥ 0.520.0%
Protected by Waratek 10 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 3 30.0% High 3 30.0% Medium 4 40.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 10 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 20.0% Working exploit published 0 0.0% Proof of concept only 1 10.0% Forecast only 0 0.0% No public exploit 7 70.0%
split by peak 6 / year
Protected by Waratek: 10 Medium: 4High: 3Critical: 3 blocked by ARMR today: 10 No public exploit: 7Proof of concept only: 1Exploited: 2
20141 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20151 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20160 20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20186 Protected by Waratek6 Critical2 High2 Medium2 blocked by ARMR today6 Proof of concept only1 No public exploit5 20190 20200 20211 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1
20142015201620172018201920202021
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-4104 High 2021-12-14 Protected by Waratek Exploited JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2018-10862 Medium 2018-07-27 Protected by Waratek No public exploit WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
CVE-2018-10237 Medium 2018-04-26 Protected by Waratek No public exploit Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
CVE-2018-8088 Critical 2018-03-20 Protected by Waratek No public exploit org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.
CVE-2017-7525 Critical 2018-02-06 Protected by Waratek Proof of concept only A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.
CVE-2018-5968 High 2018-01-22 Protected by Waratek No public exploit FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.
CVE-2017-7536 High 2018-01-10 Protected by Waratek No public exploit In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().
CVE-2015-7501 Critical 2017-11-09 Protected by Waratek Exploited Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVE-2014-0171 Medium 2015-01-15 Protected by Waratek No public exploit XML external entity (XXE) vulnerability in StaxXMLFactoryProvider2 in Odata4j, as used in Red Hat JBoss Data Virtualization before 6.0.0 patch 4, allows remote attackers to read arbitrary files via a crafted request to a REST endpoint.
CVE-2014-0170 Medium 2014-09-30 Protected by Waratek No public exploit Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted request to a REST endpoint, related to an XML External Entity (XXE) issue.