WaratekVRT Sign in
Reset
More filters (3)
Columns
Published from 2016-06-01✕Published to 2016-06-30✕Vendor apache✕
Overview 9 matches · 4 protected · 2 exploited · 2 CISA KEV · 4 public PoC · 4 EPSS ≥ 0.5
9matches 4protected44.4% 2exploited22.2% 2CISA KEV22.2% 4public PoC44.4% 4EPSS ≥ 0.544.4%
Protected by Waratek 5 55.6% Rule in development 0 0.0% Mitigation candidate 1 11.1% No exploit published 3 33.3%
Critical 4 44.4% High 3 33.3% Medium 2 22.2% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 44.4% partly blocked 1 11.1% not blocked 4 44.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 22.2% Working exploit published 2 22.2% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 55.6%
split by peak 9 / month
No exploit published: 3Mitigation candidate: 1Protected by Waratek: 5 Medium: 2High: 3Critical: 4 not blocked: 4partly blocked: 1blocked by ARMR today: 4 No public exploit: 5Working exploit published: 2Exploited: 2
Jun 169 Protected by Waratek5 Mitigation candidate1 No exploit published3 Critical4 High3 Medium2 blocked by ARMR today4 partly blocked1 not blocked4 Exploited2 Working exploit published2 No public exploit5
Jun 16
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2016-2174 High 2016-06-13 Protected by Waratek No public exploit SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arbitrary SQL commands via the eventTime parameter to service/plugins/policies/eventTime.
CVE-2016-4437 Critical 2016-06-07 Protected by Waratek Exploited Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
CVE-2016-3093 Medium 2016-06-07 No exploit published No public exploit Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attackers to cause a denial of service (block access to a web site) via unspecified vectors.
CVE-2016-3087 Critical 2016-06-07 Mitigation candidate Working exploit published Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
CVE-2015-7611 High 2016-06-07 Protected by Waratek Working exploit published Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unspecified vectors.
CVE-2016-4432 Critical 2016-06-01 No exploit published No public exploit The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication and consequently perform actions via vectors related to connection state logging.
CVE-2016-3094 Medium 2016-06-01 No exploit published No public exploit PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers to cause a denial of service (broker termination) via a crafted authentication attempt, which triggers an uncaught exception.
CVE-2016-3088 Critical 2016-06-01 Protected by Waratek Exploited The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTTP PUT followed by an HTTP MOVE request.
CVE-2016-2175 High 2016-06-01 Protected by Waratek No public exploit Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.