WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2012-01-01✕Published to 2012-12-31✕
Overview 9 matches · 3 exploited · 2 CISA KEV · 3 public PoC · 3 EPSS ≥ 0.5
9matches 3exploited33.3% 2CISA KEV22.2% 3public PoC33.3% 3EPSS ≥ 0.533.3%
Protected by Waratek 9 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 22.2% High 2 22.2% Medium 5 55.6% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 9 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 33.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 66.7%
split by peak 3 / month
Protected by Waratek: 9 Medium: 5High: 2Critical: 2 blocked by ARMR today: 9 No public exploit: 6Exploited: 3
Jan 121 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Feb 120 Mar 120 Apr 120 May 120 Jun 120 Jul 120 Aug 120 Sep 121 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 Oct 123 Protected by Waratek3 Critical1 High1 Medium1 blocked by ARMR today3 Exploited2 No public exploit1 Nov 123 Protected by Waratek3 Medium3 blocked by ARMR today3 No public exploit3 Dec 121 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Jan 12Feb 12Mar 12Apr 12May 12Jun 12Jul 12Aug 12Sep 12Oct 12Nov 12Dec 12
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2012-1712 High 2012-12-21 Protected by Waratek No public exploit Directory traversal vulnerability in the Liferay component in Oracle Sun GlassFish Web Space Server before 10.0 Update 7 Patch 2 has unknown impact and attack vectors.
CVE-2012-0818 Medium 2012-11-23 Protected by Waratek No public exploit RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.
CVE-2011-5245 Medium 2012-11-23 Protected by Waratek No public exploit The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.
CVE-2012-5783 Medium 2012-11-04 Protected by Waratek No public exploit Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVE-2012-3153 Medium 2012-10-16 Protected by Waratek Exploited Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the PARSEQUERY function allows remote attackers to obtain database credentials via reports/rwservlet/parsequery, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3152 to execute arbitrary code by uploading a .jsp file.
CVE-2012-3152 Critical 2012-10-16 Protected by Waratek Exploited Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.
CVE-2012-1618 High 2012-10-06 Protected by Waratek No public exploit Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default configuration of PostgreSQL 9.1, does not properly escape unspecified JDBC statement parameters, which allows remote attackers to perform SQL injection attacks. NOTE: as of 20120330, it was claimed that the upstream developer planned to dispute this issue, but an official dispute has not been posted as of 20121005.
CVE-2012-3305 Medium 2012-09-25 Protected by Waratek No public exploit Directory traversal vulnerability in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.47, 7.0 before 7.0.0.25, 8.0 before 8.0.0.5, and 8.5 before 8.5.0.1 allows remote attackers to overwrite arbitrary files via a crafted application file.
CVE-2012-0391 Critical 2012-01-08 Protected by Waratek Exploited The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.