WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor org.apache.commons✕
Overview 5 matches · 4 in Waratek scope · 2 protected · 2 exploited · 0 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
5matches 4in Waratek scope80.0% 2protected40.0% 2exploited40.0% 0CISA KEV0.0% 3public PoC60.0% 2EPSS ≥ 0.540.0%
Protected by Waratek 2 40.0% Rule in development 0 0.0% Mitigation candidate 1 20.0% No exploit published 1 20.0% Outside Waratek scope 1 20.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 5 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 40.0% partly blocked 0 0.0% not blocked 3 60.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 40.0% Working exploit published 0 0.0% Proof of concept only 1 20.0% Forecast only 0 0.0% No public exploit 2 40.0%
split by peak 2 / year
Outside Waratek scope: 1No exploit published: 1Mitigation candidate: 1Protected by Waratek: 2 Critical: 5 not blocked: 3blocked by ARMR today: 2 No public exploit: 2Proof of concept only: 1Exploited: 2
20151 Outside Waratek scope1 Critical1 not blocked1 No public exploit1 20160 20171 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20180 20190 20201 No exploit published1 Critical1 not blocked1 No public exploit1 20210 20222 Protected by Waratek1 Mitigation candidate1 Critical2 blocked by ARMR today1 not blocked1 Exploited1 Proof of concept only1
20152016201720182019202020212022
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-42889 Critical 2022-10-13 Protected by Waratek Exploited Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Text 1.10.0, which disables the problematic interpolators by default.
CVE-2022-33980 Critical 2022-07-06 Mitigation candidate Proof of concept only Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded. The standard format for interpolation is "${prefix:name}", where "prefix" is used to locate an instance of org.apache.commons.configuration2.interpol.Lookup that performs the interpolation. Starting with version 2.4 and continuing through 2.7, the set of default Lookup instances included interpolators that could result in arbitrary code execution or contact with remote servers. These lookups are: - "script" - execute expressions using the JVM script execution engine (javax.script) - "dns" - resolve dns records - "url" - load values from urls, including from remote servers Applications using the interpolation defaults in the affected versions may be vulnerable to remote code execution or unintentional contact with remote servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons Configuration 2.8.0, which disables the problematic interpolators by default.
CVE-2020-1953 Critical 2020-03-13 No exploit published No public exploit Apache Commons Configuration uses a third-party library to parse YAML files which by default allows the instantiation of classes if the YAML includes special statements. Apache Commons Configuration versions 2.2, 2.3, 2.4, 2.5, 2.6 did not change the default settings of this library. So if a YAML file was loaded from an untrusted source, it could therefore load and execute code out of the control of the host application.
CVE-2015-7501 Critical 2017-11-09 Protected by Waratek Exploited Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVE-2015-6420 Critical 2015-12-15 Outside Waratek scope No public exploit Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and Acceleration; Network and Content Security Devices; Network Management and Provisioning; Routing and Switching - Enterprise and Service Provider; Unified Computing; Voice and Unified Communications Devices; Video, Streaming, TelePresence, and Transcoding Devices; Wireless; and Cisco Hosted Services products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.