WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product zap✕
Overview 9 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
9matches 2in Waratek scope22.2% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC11.1% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 22.2% Outside Waratek scope 0 0.0% Not applicable 7 77.8% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 9 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 9 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 11.1% Proof of concept only 1 11.1% Forecast only 0 0.0% No public exploit 7 77.8%
split by peak 2 / year
Not applicable: 7No exploit published: 2 High: 9 not blocked: 9 No public exploit: 7Proof of concept only: 1Working exploit published: 1
20061 Not applicable1 High1 not blocked1 No public exploit1 20071 Not applicable1 High1 not blocked1 No public exploit1 20082 Not applicable2 High2 not blocked2 No public exploit2 20090 20100 20110 20120 20131 Not applicable1 High1 not blocked1 Working exploit published1 20140 20150 20160 20170 20180 20191 No exploit published1 High1 not blocked1 No public exploit1 20200 20210 20220 20231 Not applicable1 High1 not blocked1 No public exploit1 20240 20250 20262 No exploit published1 Not applicable1 High2 not blocked2 Proof of concept only1 No public exploit1
20062008201020122014201620182020202220242026
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-57301 High 2026-06-24 No exploit published No public exploit Jenkins OWASP ZAP Plugin 1.0.7 and earlier performs build operations on the Jenkins controller rather than the assigned agent, allowing attackers with Item/Configure permission to execute arbitrary code on the Jenkins controller.
CVE-2017-20268 High 2026-06-19 Not applicable Proof of concept only Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'eid' parameter. Attackers can send GET requests to the RSVP plugin endpoint with crafted SQL payloads to extract sensitive database information including database names and table structures.
CVE-2023-27055 High 2023-03-24 Not applicable No public exploit Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request.
CVE-2019-1003060 High 2019-04-04 No exploit published No public exploit Jenkins Official OWASP ZAP Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVE-2013-3050 High 2013-04-12 Not applicable Working exploit published SQL injection vulnerability in ZAPms 1.41 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter to product.
CVE-2008-5744 High 2008-12-26 Not applicable No public exploit Array index error in the dahdi/tor2.c driver in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check against the value of lc->sync.
CVE-2008-5396 High 2008-12-09 Not applicable No public exploit Array index error in the (1) torisa.c and (2) dahdi/tor2.c drivers in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to missing validation of the sync field associated with the ZT_SPANCONFIG ioctl.
CVE-2007-3121 High 2007-06-07 Not applicable No public exploit Buffer overflow in the CCdecode function in contrib/ntsc-cc.c in the zvbi-ntsc-cc tool in Zapping VBI Library (ZVBI) before 0.2.25 allows attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long data during a reception error. NOTE: some of these details are obtained from third party information.
CVE-2006-0046 High 2006-02-13 Not applicable No public exploit squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions.