WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product xwork✕
Overview 11 matches · 1 in Waratek scope · 1 protected · 2 exploited · 1 CISA KEV · 2 public PoC · 3 EPSS ≥ 0.5
11matches 1in Waratek scope9.1% 1protected9.1% 2exploited18.2% 1CISA KEV9.1% 2public PoC18.2% 3EPSS ≥ 0.527.3%
Protected by Waratek 1 9.1% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 4 36.4% Not applicable 6 54.5% Withdrawn CVE 0 0.0%
Critical 11 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 9.1% partly blocked 0 0.0% not blocked 10 90.9% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 18.2% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 9.1% No public exploit 8 72.7%
split by peak 5 / year
Not applicable: 6Outside Waratek scope: 4Protected by Waratek: 1 Critical: 11 not blocked: 10blocked by ARMR today: 1 No public exploit: 8Forecast only: 1Exploited: 2
20101 Not applicable1 Critical1 not blocked1 Forecast only1 20110 20121 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20130 20140 20150 20160 20170 20180 20195 Outside Waratek scope4 Not applicable1 Critical5 not blocked5 Exploited1 No public exploit4 20200 20214 Not applicable4 Critical4 not blocked4 No public exploit4
201020112012201320142015201620172018201920202021
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2020-35198 Critical 2021-05-12 Not applicable No public exploit An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.
CVE-2021-29999 Critical 2021-04-13 Not applicable No public exploit An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.
CVE-2021-29998 Critical 2021-04-13 Not applicable No public exploit An issue was discovered in Wind River VxWorks before 6.5. There is a possible heap overflow in dhcp client.
CVE-2016-20009 Critical 2021-03-11 Not applicable No public exploit A DNS client stack-based buffer overflow in ipdnsc_decode_name() affects Wind River VxWorks 6.5 through 7. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVE-2019-12262 Critical 2019-08-14 Not applicable No public exploit Wind River VxWorks 6.6, 6.7, 6.8, 6.9 and 7 has Incorrect Access Control in the RARP client component. IPNET security vulnerability: Handling of unsolicited Reverse ARP replies (Logical Flaw).
CVE-2019-12261 Critical 2019-08-09 Outside Waratek scope No public exploit Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 3 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion during connect() to a remote host.
CVE-2019-12260 Critical 2019-08-09 Outside Waratek scope No public exploit Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). This is an IPNET security vulnerability: TCP Urgent Pointer state confusion caused by a malformed TCP AO option.
CVE-2019-12256 Critical 2019-08-09 Outside Waratek scope No public exploit Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. There is an IPNET security vulnerability: Stack overflow in the parsing of IPv4 packets’ IP options.
CVE-2019-12255 Critical 2019-08-09 Outside Waratek scope Exploited Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). This is a IPNET security vulnerability: TCP Urgent Pointer = 0 that leads to an integer underflow.
CVE-2012-0391 Critical 2012-01-08 Protected by Waratek Exploited The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
CVE-2010-2965 Critical 2010-08-05 Not applicable Forecast only The WDB target agent debug service in Wind River VxWorks 6.x, 5.x, and earlier, as used on the Rockwell Automation 1756-ENBT series A with firmware 3.2.6 and 3.6.1 and other products, allows remote attackers to read or modify arbitrary memory locations, perform function calls, or manage tasks via requests to UDP port 17185, a related issue to CVE-2005-3804.