WaratekVRT Sign in
Reset
More filters (3)
Columns
Published from 2017-01-01✕Published to 2017-12-31✕Vendor org.apache.tomcat.embed✕
Overview 5 matches · 0 protected · 2 exploited · 2 CISA KEV · 2 public PoC · 2 EPSS ≥ 0.5
5matches 0protected0.0% 2exploited40.0% 2CISA KEV40.0% 2public PoC40.0% 2EPSS ≥ 0.540.0%
Protected by Waratek 2 40.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 60.0%
Critical 3 60.0% High 2 40.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 2 40.0% not blocked 3 60.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 40.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 60.0%
split by peak 2 / month
No exploit published: 3Protected by Waratek: 2 High: 2Critical: 3 not blocked: 3partly blocked: 2 No public exploit: 3Exploited: 2
Apr 172 No exploit published2 Critical2 not blocked2 No public exploit2 May 170 Jun 170 Jul 170 Aug 171 No exploit published1 Critical1 not blocked1 No public exploit1 Sep 171 Protected by Waratek1 High1 partly blocked1 Exploited1 Oct 171 Protected by Waratek1 High1 partly blocked1 Exploited1
Apr 17May 17Jun 17Jul 17Aug 17Sep 17Oct 17
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2017-12617 High 2017-10-04 Protected by Waratek Exploited When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2017-12615 High 2017-09-19 Protected by Waratek Exploited When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.
CVE-2016-5018 Critical 2017-08-10 No exploit published No public exploit In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.
CVE-2017-5651 Critical 2017-04-17 No exploit published No public exploit In Apache Tomcat 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, the refactoring of the HTTP connectors introduced a regression in the send file processing. If the send file processing completed quickly, it was possible for the Processor to be added to the processor cache twice. This could result in the same Processor being used for multiple requests which in turn could lead to unexpected errors and/or response mix-up.
CVE-2017-5648 Critical 2017-04-17 No exploit published No public exploit While investigating bug 60718, it was noticed that some calls to application listeners in Apache Tomcat 9.0.0.M1 to 9.0.0.M17, 8.5.0 to 8.5.11, 8.0.0.RC1 to 8.0.41, and 7.0.0 to 7.0.75 did not use the appropriate facade object. When running an untrusted application under a SecurityManager, it was therefore possible for that untrusted application to retain a reference to the request or response object and thereby access and/or modify information associated with another web application.