WaratekVRT Sign in
Reset
More filters (1)
Columns
Published to 2015-05-31✕
Overview 7 matches · 5 protected · 5 exploited · 5 CISA KEV · 4 public PoC · 4 EPSS ≥ 0.5
7matches 5protected71.4% 5exploited71.4% 5CISA KEV71.4% 4public PoC57.1% 4EPSS ≥ 0.557.1%
Protected by Waratek 5 71.4% Rule in development 0 0.0% Mitigation candidate 1 14.3% No exploit published 1 14.3%
Critical 7 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 71.4% partly blocked 0 0.0% not blocked 1 14.3% not established 1 14.3% unrecorded 0 0.0%
Exploited 5 71.4% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 28.6%
split by peak 3 / year
No exploit published: 1Mitigation candidate: 1Protected by Waratek: 5 Critical: 7 not established: 1not blocked: 1blocked by ARMR today: 5 No public exploit: 2Exploited: 5
20051 No exploit published1 Critical1 not blocked1 No public exploit1 20060 20070 20080 20090 20101 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 20110 20123 Protected by Waratek2 Mitigation candidate1 Critical3 blocked by ARMR today2 not established1 Exploited3 20131 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20140 20151 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1
20052006200720082009201020112012201320142015
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2015-1427 Critical 2015-02-17 Protected by Waratek Exploited The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
CVE-2013-2251 Critical 2013-07-20 Protected by Waratek Exploited Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CVE-2012-3152 Critical 2012-10-16 Protected by Waratek Exploited Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Report Server Component. NOTE: the previous information is from the October 2012 CPU. Oracle has not commented on claims from the original researcher that the URLPARAMETER functionality allows remote attackers to read and upload arbitrary files to reports/rwservlet, and that this issue occurs in earlier versions. NOTE: this can be leveraged with CVE-2012-3153 to execute arbitrary code by uploading a .jsp file.
CVE-2012-1710 Critical 2012-05-03 Mitigation candidate Exploited Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Designer, a different vulnerability than CVE-2012-1709.
CVE-2012-0391 Critical 2012-01-08 Protected by Waratek Exploited The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for mismatched data types of properties, which allows remote attackers to execute arbitrary Java code via a crafted parameter.
CVE-2010-2076 Critical 2010-08-19 Protected by Waratek No public exploit Apache CXF 2.0.x before 2.0.13, 2.1.x before 2.1.10, and 2.2.x before 2.2.9, as used in Apache ServiceMix, Apache Camel, Apache Chemistry, Apache jUDDI, Apache Geronimo, and other products, does not properly reject DTDs in SOAP messages, which allows remote attackers to read arbitrary files, send HTTP requests to intranet servers, or cause a denial of service (CPU and memory consumption) via a crafted DTD, as demonstrated by an entity declaration in a request to samples/wsdl_first_pure_xml, a similar issue to CVE-2010-1632.
CVE-2005-1744 Critical 2005-05-24 No exploit published No public exploit BEA WebLogic Server and WebLogic Express 7.0 through Service Pack 5 does not log out users when an application is redeployed, which allows those users to continue to access the application without having to log in again, which may be in violation of newly changed security constraints or role mappings.