WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Product zap✕
Overview 15 matches · 4 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
15matches 4in Waratek scope26.7% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC6.7% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 26.7% Outside Waratek scope 0 0.0% Not applicable 11 73.3% Withdrawn CVE 0 0.0%
Critical 1 6.7% High 9 60.0% Medium 5 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 15 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 6.7% Proof of concept only 1 6.7% Forecast only 0 0.0% No public exploit 13 86.7%
split by peak 2 / year
Not applicable: 11No exploit published: 4 Medium: 5High: 9Critical: 1 not blocked: 15 No public exploit: 13Proof of concept only: 1Working exploit published: 1
20021 Not applicable1 Medium1 not blocked1 No public exploit1 20030 20040 20050 20061 Not applicable1 High1 not blocked1 No public exploit1 20072 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20082 Not applicable2 High2 not blocked2 No public exploit2 20090 20100 20110 20120 20131 Not applicable1 High1 not blocked1 Working exploit published1 20140 20150 20160 20170 20180 20191 No exploit published1 High1 not blocked1 No public exploit1 20201 No exploit published1 Medium1 not blocked1 No public exploit1 20211 Not applicable1 Medium1 not blocked1 No public exploit1 20222 No exploit published1 Not applicable1 Critical1 Medium1 not blocked2 No public exploit2 20231 Not applicable1 High1 not blocked1 No public exploit1 20240 20250 20262 No exploit published1 Not applicable1 High2 not blocked2 Proof of concept only1 No public exploit1
2002200420062008201020122014201620182020202220242026
15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-57301 High 2026-06-24 No exploit published No public exploit Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
CVE-2017-20268 High 2026-06-19 Not applicable Proof of concept only Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'eid' parameter. Attackers can send GET requests to the RSVP plugin endpoint with crafted SQL payloads to extract sensitive database information including database names and table structures.
CVE-2023-27055 High 2023-03-24 Not applicable No public exploit Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request.
CVE-2022-28802 Critical 2022-09-21 Not applicable No public exploit Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company's account, but was supposed to enforce role-based access control within that company's account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren't supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)
CVE-2022-27820 Medium 2022-03-24 No exploit published No public exploit OWASP Zed Attack Proxy (ZAP) through w2022-03-21 does not verify the TLS certificate chain of an HTTPS server.
CVE-2021-39360 Medium 2021-08-22 Not applicable No public exploit In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVE-2020-2214 Medium 2020-07-02 No exploit published No public exploit Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2019-1003060 High 2019-04-04 No exploit published No public exploit Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVE-2013-3050 High 2013-04-12 Not applicable Working exploit published SQL injection vulnerability in ZAPms 1.41 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter to product.
CVE-2008-5744 High 2008-12-26 Not applicable No public exploit Array index error in the dahdi/tor2.c driver in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check against the value of lc->sync.
CVE-2008-5396 High 2008-12-09 Not applicable No public exploit Array index error in the (1) torisa.c and (2) dahdi/tor2.c drivers in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to missing validation of the sync field associated with the ZT_SPANCONFIG ioctl.
CVE-2007-5690 Medium 2007-10-29 Not applicable No public exploit Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name (interface name) in the ifr_name field. NOTE: the vendor disputes this issue, stating that the application requires root access, so privilege boundaries are not crossed
CVE-2007-3121 High 2007-06-07 Not applicable No public exploit Buffer overflow in the CCdecode function in contrib/ntsc-cc.c in the zvbi-ntsc-cc tool in Zapping VBI Library (ZVBI) before 0.2.25 allows attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long data during a reception error. NOTE: some of these details are obtained from third party information.
CVE-2006-0046 High 2006-02-13 Not applicable No public exploit squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions.
CVE-2002-2377 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in addentry.cgi in ZAP 1.0.3 allows remote attackers to inject arbitrary SSi directives, web script, and HTML via the entry field.