Overview 10 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
1
10.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
9
90.0%
blocked by ARMR today
1
10.0%
partly blocked
0
0.0%
not blocked
9
90.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
10
100.0%
split by
peak 10 / month
Jun 17
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2017-7677 | Medium | 2017-06-14 | No exploit published | No public exploit | In environments that use external location for hive tables, Hive Authorizer in Apache Ranger before 0.7.1 should be checking RWX permission for create table. |
| CVE-2016-8751 | Medium | 2017-06-14 | No exploit published | No public exploit | Apache Ranger before 0.6.3 is vulnerable to a Stored Cross-Site Scripting in when entering custom policy conditions. Admin users can store some arbitrary javascript code to be executed when normal users login and access policies. |
| CVE-2016-8746 | Medium | 2017-06-14 | No exploit published | No public exploit | Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true. |
| CVE-2017-4974 | Medium | 2017-06-13 | Protected by Waratek | No public exploit | An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v258; UAA release 2.x versions prior to v2.7.4.15, 3.6.x versions prior to v3.6.9, 3.9.x versions prior to v3.9.11, and other versions prior to v3.16.0; and UAA bosh release (uaa-release) 13.x versions prior to v13.13, 24.x versions prior to v24.8, and other versions prior to v30.1. An authorized user can use a blind SQL injection attack to query the contents of the UAA database, aka "Blind SQL Injection with privileged UAA endpoints." |
| CVE-2017-4971 | Medium | 2017-06-13 | No exploit published | No public exploit | An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property which is disabled by default (i.e., set to 'false') can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings. |
| CVE-2017-7665 | Medium | 2017-06-12 | No exploit published | No public exploit | In Apache NiFi before 0.7.4 and 1.x before 1.3.0, there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient. |
| CVE-2016-9736 | Medium | 2017-06-08 | No exploit published | No public exploit | IBM WebSphere Application Server using malformed SOAP requests could allow a remote attacker to obtain sensitive information. |
| CVE-2016-5004 | Medium | 2017-06-06 | No exploit published | No public exploit | The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service (resource consumption) by decompressing a large file containing zeroes. |
| CVE-2016-3077 | Medium | 2017-06-06 | No exploit published | No public exploit | The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process crash) for all VMs. |
| CVE-2016-0767 | Medium | 2017-06-06 | No exploit published | No public exploit | PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema classpath. |