WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Protection: None✕Vendor com.alibaba✕
Overview 7 matches · 5 in Waratek scope · 0 protected · 2 exploited · 0 CISA KEV · 3 public PoC · 1 EPSS ≥ 0.5
7matches 5in Waratek scope71.4% 0protected0.0% 2exploited28.6% 0CISA KEV0.0% 3public PoC42.9% 1EPSS ≥ 0.514.3%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 28.6% No exploit published 3 42.9% Outside Waratek scope 2 28.6% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 5 71.4% High 0 0.0% Medium 2 28.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 7 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 28.6% Working exploit published 0 0.0% Proof of concept only 2 28.6% Forecast only 1 14.3% No public exploit 2 28.6%
split by peak 3 / year
Outside Waratek scope: 2No exploit published: 3Mitigation candidate: 2 Medium: 2Critical: 5 not blocked: 7 No public exploit: 2Forecast only: 1Proof of concept only: 2Exploited: 2
20181 Outside Waratek scope1 Critical1 not blocked1 Exploited1 20190 20200 20213 Mitigation candidate1 No exploit published2 Critical2 Medium1 not blocked3 Proof of concept only1 Forecast only1 No public exploit1 20222 Mitigation candidate1 No exploit published1 Critical1 Medium1 not blocked2 Proof of concept only1 No public exploit1 20230 20240 20250 20261 Outside Waratek scope1 Critical1 not blocked1 Exploited1
201820192020202120222023202420252026
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-70974 Critical 2026-01-09 Outside Waratek scope Exploited Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an attacker-supplied payload located elsewhere in that JSON document. This was exploited in the wild in 2023 through 2025. NOTE: this issue exists because of an incomplete fix for CVE-2017-18349. Also, a later bypass is covered by CVE-2022-25845.
CVE-2022-25845 Critical 2022-06-10 Mitigation candidate Proof of concept only The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode).
CVE-2022-24969 Medium 2022-06-09 No exploit published No public exploit bypass CVE-2021-25640 > In Apache Dubbo prior to 2.6.12 and 2.7.15, the usage of parseURL method will lead to the bypass of the white host check which can cause open redirect or SSRF vulnerability.
CVE-2021-30181 Critical 2021-06-01 No exploit published Forecast only Apache Dubbo prior to 2.6.9 and 2.7.9 supports Script routing which will enable a customer to route the request to the right server. These rules are used by the customers when making a request in order to find the right endpoint. When parsing these rules, Dubbo customers use ScriptEngine and run the rule provided by the script which by default may enable executing arbitrary code.
CVE-2021-25641 Critical 2021-06-01 Mitigation candidate Proof of concept only Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versions before 2.7.8 or 2.6.9, an attacker can choose which serialization id the Provider will use by tampering with the byte preamble flags, aka, not following the server's instruction. This means that if a weak deserializer such as the Kryo and FST are somehow in code scope (e.g. if Kryo is somehow a part of a dependency), a remote unauthenticated attacker can tell the Provider to use the weak deserializer, and then proceed to exploit it.
CVE-2021-25640 Medium 2021-06-01 No exploit published No public exploit In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redirect or SSRF vulnerability.
CVE-2017-18349 Critical 2018-10-23 Outside Waratek scope Exploited parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is mishandled in AjaxApplication.java.