WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product web analytics✕
Overview 10 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 4 public PoC · 1 EPSS ≥ 0.5
10matches 0in Waratek scope0.0% 0protected0.0% 1exploited10.0% 0CISA KEV0.0% 4public PoC40.0% 1EPSS ≥ 0.510.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 10 100.0% Withdrawn CVE 0 0.0%
Critical 2 20.0% High 3 30.0% Medium 5 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 10 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 10.0% Working exploit published 3 30.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 60.0%
split by peak 2 / year
Not applicable: 10 Medium: 5High: 3Critical: 2 not blocked: 10 No public exploit: 6Working exploit published: 3Exploited: 1
20102 Not applicable2 Medium2 not blocked2 Working exploit published2 20110 20120 20130 20142 Not applicable2 High1 Medium1 not blocked2 Working exploit published1 No public exploit1 20151 Not applicable1 Medium1 not blocked1 No public exploit1 20160 20170 20182 Not applicable2 Critical1 High1 not blocked2 No public exploit2 20190 20200 20210 20221 Not applicable1 Critical1 not blocked1 Exploited1 20232 Not applicable2 High1 Medium1 not blocked2 No public exploit2
2011201320152017201920212023
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-45057 Medium 2023-10-18 Not applicable No public exploit Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions.
CVE-2023-45268 High 2023-10-13 Not applicable No public exploit Cross-Site Request Forgery (CSRF) vulnerability in Hitsteps Hitsteps Web Analytics plugin <= 5.86 versions.
CVE-2022-24637 Critical 2022-03-18 Not applicable Exploited Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
CVE-2014-2294 Critical 2018-04-17 Not applicable No public exploit Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event parameter to queue.php.
CVE-2014-1457 High 2018-03-20 Not applicable No public exploit Open Web Analytics (OWA) before 1.5.6 improperly generates random nonce values, which makes it easier for remote attackers to bypass a CSRF protection mechanism by leveraging knowledge of an OWA user name.
CVE-2015-7786 Medium 2015-12-29 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the NTT DATA Smart Sourcing JavaScript module 2003-11-26 through 2013-07-09 for Web Analytics Service allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2014-1456 Medium 2014-03-01 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in the login page in Open Web Analytics (OWA) before 1.5.6 allows remote attackers to inject arbitrary web script or HTML via the owa_user_id parameter to index.php.
CVE-2014-1206 High 2014-01-15 Not applicable Working exploit published SQL injection vulnerability in the password reset page in Open Web Analytics (OWA) before 1.5.5 allows remote attackers to execute arbitrary SQL commands via the owa_email_address parameter in a base.passwordResetRequest action to index.php.
CVE-2010-2677 Medium 2010-07-08 Not applicable Working exploit published PHP remote file inclusion vulnerability in mw_plugin.php in Open Web Analytics (OWA) 1.2.3, when magic_quotes_gpc is disabled and register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the IP parameter. NOTE: some of these details are obtained from third party information.
CVE-2010-2676 Medium 2010-07-08 Not applicable Working exploit published Multiple directory traversal vulnerabilities in index.php in Open Web Analytics (OWA) 1.2.3 might allow remote attackers to read arbitrary files via directory traversal sequences in the (1) owa_action and (2) owa_do parameters.