WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor softwareag✕
Overview 5 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
5matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 20.0% Not applicable 4 80.0% Withdrawn CVE 0 0.0%
Critical 5 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 5 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 20.0% Forecast only 0 0.0% No public exploit 4 80.0%
split by peak 2 / quarter
Not applicable: 4Outside Waratek scope: 1 Critical: 5 not blocked: 5 No public exploit: 4Proof of concept only: 1
Q3 191 Outside Waratek scope1 Critical1 not blocked1 No public exploit1 Q4 190 Q1 200 Q2 200 Q3 200 Q4 201 Not applicable1 Critical1 not blocked1 No public exploit1 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 221 Not applicable1 Critical1 not blocked1 No public exploit1 Q3 220 Q4 220 Q1 230 Q2 230 Q3 232 Not applicable2 Critical2 not blocked2 Proof of concept only1 No public exploit1
Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22Q1 23Q3 23
5 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-0925 Critical 2023-09-06 Not applicable No public exploit Version 10.11 of webMethods OneData runs an embedded instance of Azul Zulu Java 11.0.15 which hosts a Java RMI registry (listening on TCP port 2099 by default) and two RMI interfaces (listening on a single, dynamically assigned TCP high port). Port 2099 serves as a Java Remote Method Invocation (RMI) registry which allows for remotely loading and processing data via RMI interfaces. An unauthenticated attacker with network connectivity to the RMI registry and RMI interface ports can abuse this functionality to instruct the webMethods OneData application to load a malicious serialized Java object as a parameter to one of the available Java methods presented by the RMI interface. Once deserialized on the vulnerable server, the malicious code runs as whichever operating system account is used to run the software, which in most cases is the local System account on Windows.
CVE-2023-39017 Critical 2023-07-28 Not applicable Proof of concept only quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that untrusted user input would reach the code location where injection must occur.
CVE-2021-33207 Critical 2022-04-05 Not applicable No public exploit The HTTP client in MashZone NextGen through 10.7 GA deserializes untrusted data when it gets an HTTP response with a 570 status code.
CVE-2020-35469 Critical 2020-12-16 Not applicable No public exploit The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versions of the Terracotta Server OSS container may allow a remote attacker to achieve root access with a blank password.
CVE-2019-13990 Critical 2019-07-26 Outside Waratek scope No public exploit initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.