Overview 6 matches · 5 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
Protected by Waratek
5
83.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
1
16.7%
blocked by ARMR today
5
83.3%
partly blocked
0
0.0%
not blocked
1
16.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
1
16.7%
Forecast only
2
33.3%
No public exploit
3
50.0%
split by
peak 3 / month
Jan 143
Protected by Waratek3
Medium3
blocked by ARMR today3
Forecast only1
No public exploit2
Feb 140
Mar 141
No exploit published1
Medium1
not blocked1
No public exploit1
Apr 141
Protected by Waratek1
Medium1
blocked by ARMR today1
Forecast only1
May 140
Jun 140
Jul 140
Aug 140
Sep 140
Oct 140
Nov 141
Protected by Waratek1
Medium1
blocked by ARMR today1
Proof of concept only1
Jan 14Feb 14Mar 14Apr 14May 14Jun 14Jul 14Aug 14Sep 14Oct 14Nov 14
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2014-3625 | Medium | 2014-11-20 | Protected by Waratek | Proof of concept only | Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling. |
| CVE-2014-0054 | Medium | 2014-04-17 | Protected by Waratek | Forecast only | The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429. |
| CVE-2014-1904 | Medium | 2014-03-20 | No exploit published | No public exploit | Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action. |
| CVE-2013-6429 | Medium | 2014-01-26 | Protected by Waratek | Forecast only | The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315. |
| CVE-2013-7315 | Medium | 2014-01-23 | Protected by Waratek | No public exploit | The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInputFactory, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152. NOTE: this issue was SPLIT from CVE-2013-4152 due to different affected versions. |
| CVE-2013-4152 | Medium | 2014-01-23 | Protected by Waratek | No public exploit | The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue. |