WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product zap✕
Overview 11 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
11matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC9.1% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 11 100.0% Withdrawn CVE 0 0.0%
Critical 1 9.1% High 7 63.6% Medium 3 27.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 9.1% Proof of concept only 1 9.1% Forecast only 0 0.0% No public exploit 9 81.8%
split by peak 2 / year
Not applicable: 11 Medium: 3High: 7Critical: 1 not blocked: 11 No public exploit: 9Proof of concept only: 1Working exploit published: 1
20021 Not applicable1 Medium1 not blocked1 No public exploit1 20030 20040 20050 20061 Not applicable1 High1 not blocked1 No public exploit1 20072 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20082 Not applicable2 High2 not blocked2 No public exploit2 20090 20100 20110 20120 20131 Not applicable1 High1 not blocked1 Working exploit published1 20140 20150 20160 20170 20180 20190 20200 20211 Not applicable1 Medium1 not blocked1 No public exploit1 20221 Not applicable1 Critical1 not blocked1 No public exploit1 20231 Not applicable1 High1 not blocked1 No public exploit1 20240 20250 20261 Not applicable1 High1 not blocked1 Proof of concept only1
2002200420062008201020122014201620182020202220242026
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2017-20268 High 2026-06-19 Not applicable Proof of concept only Joomla! Component Zap Calendar Lite 4.3.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'eid' parameter. Attackers can send GET requests to the RSVP plugin endpoint with crafted SQL payloads to extract sensitive database information including database names and table structures.
CVE-2023-27055 High 2023-03-24 Not applicable No public exploit Aver Information Inc PTZApp2 v20.01044.48 allows attackers to access sensitive files via a crafted GET request.
CVE-2022-28802 Critical 2022-09-21 Not applicable No public exploit Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company's account, but was supposed to enforce role-based access control within that company's account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren't supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)
CVE-2021-39360 Medium 2021-08-22 Not applicable No public exploit In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011.
CVE-2013-3050 High 2013-04-12 Not applicable Working exploit published SQL injection vulnerability in ZAPms 1.41 and earlier allows remote attackers to execute arbitrary SQL commands via the pid parameter to product.
CVE-2008-5744 High 2008-12-26 Not applicable No public exploit Array index error in the dahdi/tor2.c driver in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to an incorrect tor2 patch for CVE-2008-5396 that uses the wrong variable in a range check against the value of lc->sync.
CVE-2008-5396 High 2008-12-09 Not applicable No public exploit Array index error in the (1) torisa.c and (2) dahdi/tor2.c drivers in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kernel memory by writing to /dev/zap/ctl, related to missing validation of the sync field associated with the ZT_SPANCONFIG ioctl.
CVE-2007-5690 Medium 2007-10-29 Not applicable No public exploit Buffer overflow in sethdlc.c in the Asterisk Zaptel 1.4.5.1 might allow local users to gain privileges via a long device name (interface name) in the ifr_name field. NOTE: the vendor disputes this issue, stating that the application requires root access, so privilege boundaries are not crossed
CVE-2007-3121 High 2007-06-07 Not applicable No public exploit Buffer overflow in the CCdecode function in contrib/ntsc-cc.c in the zvbi-ntsc-cc tool in Zapping VBI Library (ZVBI) before 0.2.25 allows attackers to cause a denial of service (application crash) and possibly execute arbitrary code via long data during a reception error. NOTE: some of these details are obtained from third party information.
CVE-2006-0046 High 2006-02-13 Not applicable No public exploit squid_redirect script in adzapper before 2006-01-29 allows remote attackers to cause a denial of service (CPU consumption) via a URL with a large number of trailing / (forward slashes), which might produce inefficient regular expressions.
CVE-2002-2377 Medium 2002-12-31 Not applicable No public exploit Cross-site scripting (XSS) vulnerability in addentry.cgi in ZAP 1.0.3 allows remote attackers to inject arbitrary SSi directives, web script, and HTML via the entry field.