Overview 66 matches · 0 in Waratek scope · 0 protected · 4 exploited · 0 CISA KEV · 22 public PoC · 5 EPSS ≥ 0.5
66matches
0in Waratek scope0.0%
0protected0.0%
4exploited6.1%
0CISA KEV0.0%
22public PoC33.3%
5EPSS ≥ 0.57.6%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
66
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
66
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 8 / year
19962
Not applicable2
High2
not blocked2
No public exploit2
19972
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
19983
Not applicable3
High3
not blocked3
Working exploit published1
No public exploit2
19994
Not applicable4
High4
not blocked4
Working exploit published1
No public exploit3
20006
Not applicable6
High6
not blocked6
Working exploit published3
No public exploit3
20018
Not applicable8
High8
not blocked8
Exploited1
Working exploit published2
No public exploit5
20024
Not applicable4
High4
not blocked4
Working exploit published1
No public exploit3
20035
Not applicable5
High5
not blocked5
Exploited2
Working exploit published1
No public exploit2
20042
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20052
Not applicable2
High2
not blocked2
No public exploit2
20065
Not applicable5
High5
not blocked5
Working exploit published1
No public exploit4
20071
Not applicable1
High1
not blocked1
No public exploit1
20087
Not applicable7
High7
not blocked7
Working exploit published2
Proof of concept only1
No public exploit4
20091
Not applicable1
High1
not blocked1
Working exploit published1
20100
20111
Not applicable1
High1
not blocked1
No public exploit1
20122
Not applicable2
High2
not blocked2
Working exploit published1
No public exploit1
20130
20141
Not applicable1
High1
not blocked1
Working exploit published1
20150
20160
20171
Not applicable1
High1
not blocked1
Working exploit published1
20180
20191
Not applicable1
High1
not blocked1
No public exploit1
20202
Not applicable2
High2
not blocked2
No public exploit2
20214
Not applicable4
High4
not blocked4
No public exploit4
20220
20231
Not applicable1
High1
not blocked1
No public exploit1
20241
Not applicable1
High1
not blocked1
Exploited1
1997200020032006200920122015201820212024
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-6387 | High | 2024-07-01 | Not applicable | Exploited | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period. |
| CVE-2023-45198 | High | 2023-10-05 | Not applicable | No public exploit | ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. tnftpd (the portable version of NetBSD ftpd) before 20231001 is also vulnerable. |
| CVE-2021-45489 | High | 2021-12-25 | Not applicable | No public exploit | In NetBSD through 9.2, the IPv6 Flow Label generation algorithm employs a weak cryptographic PRNG. |
| CVE-2021-45488 | High | 2021-12-25 | Not applicable | No public exploit | In NetBSD through 9.2, there is an information leak in the TCP ISN (ISS) generation algorithm. |
| CVE-2021-45487 | High | 2021-12-25 | Not applicable | No public exploit | In NetBSD through 9.2, the IPv4 ID generation algorithm does not use appropriate cryptographic measures. |
| CVE-2021-45484 | High | 2021-12-25 | Not applicable | No public exploit | In NetBSD through 9.2, the IPv6 fragment ID generation algorithm employs a weak cryptographic PRNG. |
| CVE-2012-5365 | High | 2020-02-20 | Not applicable | No public exploit | The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Router Advertisement packets containing multiple Routing entries. |
| CVE-2012-5363 | High | 2020-02-20 | Not applicable | No public exploit | The IPv6 implementation in FreeBSD and NetBSD (unknown versions, year 2012 and earlier) allows remote attackers to cause a denial of service via a flood of ICMPv6 Neighbor Solicitation messages, a different vulnerability than CVE-2011-2393. |
| CVE-2011-2480 | High | 2019-11-27 | Not applicable | No public exploit | Information Disclosure vulnerability in the 802.11 stack, as used in FreeBSD before 8.2 and NetBSD when using certain non-x86 architectures. A signedness error in the IEEE80211_IOC_CHANINFO ioctl allows a local unprivileged user to cause the kernel to copy large amounts of kernel memory back to the user, disclosing potentially sensitive information. |
| CVE-2016-6253 | High | 2017-01-20 | Not applicable | Working exploit published | mail.local in NetBSD versions 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox. |
| CVE-2014-8517 | High | 2014-11-17 | Not applicable | Working exploit published | The fetch_url function in usr.bin/ftp/fetch.c in tnftp, as used in NetBSD 5.1 through 5.1.4, 5.2 through 5.2.2, 6.0 through 6.0.6, and 6.1 through 6.1.5 allows remote attackers to execute arbitrary commands via a | (pipe) character at the end of an HTTP redirect. |
| CVE-2012-0217 | High | 2012-06-12 | Not applicable | Working exploit published | The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta and earlier; Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1; and possibly other operating systems, when running on an Intel processor, incorrectly uses the sysret path in cases where a certain address is not a canonical address, which allows local users to gain privileges via a crafted application. NOTE: because this issue is due to incorrect use of the Intel specification, it should have been split into separate identifiers; however, there was some value in preserving the original mapping of the multi-codebase coordinated-disclosure effort to a single identifier. |
| CVE-2011-2393 | High | 2012-02-02 | Not applicable | No public exploit | The Neighbor Discovery (ND) protocol implementation in the IPv6 stack in FreeBSD, NetBSD, and possibly other BSD-based operating systems allows remote attackers to cause a denial of service (CPU consumption and device hang) by sending many Router Advertisement (RA) messages with different source addresses, a similar vulnerability to CVE-2010-4670. |
| CVE-2011-2895 | High | 2011-08-19 | Not applicable | No public exploit | The LZW decompressor in (1) the BufCompressedFill function in fontfile/decompress.c in X.Org libXfont before 1.4.4 and (2) compress/compress.c in 4.3BSD, as used in zopen.c in OpenBSD before 3.8, FreeBSD, NetBSD 4.0.x and 5.0.x before 5.0.3 and 5.1.x before 5.1.1, FreeType 2.1.9, and other products, does not properly handle code words that are absent from the decompression table when encountered, which allows context-dependent attackers to trigger an infinite loop or a heap-based buffer overflow, and possibly execute arbitrary code, via a crafted compressed stream, a related issue to CVE-2006-1168 and CVE-2011-2896. |
| CVE-2009-0687 | High | 2009-08-11 | Not applicable | Working exploit published | The pf_test_rule function in OpenBSD Packet Filter (PF), as used in OpenBSD 4.2 through 4.5, NetBSD 5.0 before RC3, MirOS 10 and earlier, and MidnightBSD 0.3-current allows remote attackers to cause a denial of service (panic) via crafted IP packets that trigger a NULL pointer dereference during translation, related to an IPv4 packet with an ICMPv6 payload. |
| CVE-2008-4609 | High | 2008-10-20 | Not applicable | Proof of concept only | The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress. |
| CVE-2008-2476 | High | 2008-10-03 | Not applicable | No public exploit | The IPv6 Neighbor Discovery Protocol (NDP) implementation in (1) FreeBSD 6.3 through 7.1, (2) OpenBSD 4.2 and 4.3, (3) NetBSD, (4) Force10 FTOS before E7.7.1.1, (5) Juniper JUNOS, and (6) Wind River VxWorks 5.x through 6.4 does not validate the origin of Neighbor Discovery messages, which allows remote attackers to cause a denial of service (loss of connectivity) or read private network traffic via a spoofed message that modifies the Forward Information Base (FIB). |
| CVE-2008-4247 | High | 2008-09-25 | Not applicable | Working exploit published | ftpd in OpenBSD 4.3, FreeBSD 7.0, NetBSD 4.0, Solaris, and possibly other operating systems interprets long commands from an FTP client as multiple commands, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks and execute arbitrary FTP commands via a long ftp:// URI that leverages an existing session from the FTP client implementation in a web browser. |
| CVE-2008-3584 | High | 2008-09-11 | Not applicable | No public exploit | NetBSD 3.0, 3.1, and 4.0, when a pppoe instance exists, does not properly check the length of a PPPoE packet tag, which allows remote attackers to cause a denial of service (system crash) via a crafted PPPoE packet. |
| CVE-2008-2464 | High | 2008-09-11 | Not applicable | No public exploit | The mld_input function in sys/netinet6/mld6.c in the kernel in NetBSD 4.0, FreeBSD, and KAME, when INET6 is enabled, allows remote attackers to cause a denial of service (divide-by-zero error and panic) via a malformed ICMPv6 Multicast Listener Discovery (MLD) query with a certain Maximum Response Delay value. |
| CVE-2008-1391 | High | 2008-03-27 | Not applicable | Working exploit published | Multiple integer overflows in libc in NetBSD 4.x, FreeBSD 6.x and 7.x, and probably other BSD and Apple Mac OS platforms allow context-dependent attackers to execute arbitrary code via large values of certain integer fields in the format argument to (1) the strfmon function in lib/libc/stdlib/strfmon.c, related to the GET_NUMBER macro; and (2) the printf function, related to left_prec and right_prec. |
| CVE-2008-1335 | High | 2008-03-13 | Not applicable | No public exploit | The ipsec4_get_ulp function in the kernel in NetBSD 2.0 through 3.1 and NetBSD-current before 20071028, when the fast_ipsec subsystem is enabled, allows remote attackers to bypass the IPsec policy by sending packets from a source machine with a different endianness than the destination machine, a different vulnerability than CVE-2006-0905. |
| CVE-2007-1523 | High | 2007-03-20 | Not applicable | No public exploit | Heap-based buffer overflow in the kernel in NetBSD 3.0, certain versions of FreeBSD and OpenBSD, and possibly other BSD derived operating systems allows local users to have an unknown impact. NOTE: this information is based upon a vague pre-advisory with no actionable information. Details will be updated after 20070329. |
| CVE-2006-6652 | High | 2006-12-20 | Not applicable | Working exploit published | Buffer overflow in the glob implementation (glob.c) in libc in NetBSD-current before 20050914, NetBSD 2.* and 3.* before 20061203, and Apple Mac OS X before 2007-004, as used by the FTP daemon and tnftpd, allows remote authenticated users to execute arbitrary code via a long pathname that results from path expansion. |
| CVE-2006-6165 | High | 2006-11-29 | Not applicable | No public exploit | ld.so in FreeBSD, NetBSD, and possibly other BSD distributions does not remove certain harmful environment variables, which allows local users to gain privileges by passing certain environment variables to loading processes. NOTE: this issue has been disputed by a third party, stating that it is the responsibility of the application to properly sanitize the environment |
| CVE-2006-6014 | High | 2006-11-21 | Not applicable | No public exploit | The NetBSD-current kernel before 20061028 does not properly perform bounds checking of an unspecified userspace parameter in the ptrace system call during a PT_DUMPCORE request, which allows local users to have an unknown impact. |
| CVE-2006-4304 | High | 2006-08-24 | Not applicable | No public exploit | Buffer overflow in the sppp driver in FreeBSD 4.11 through 6.1, NetBSD 2.0 through 4.0 beta before 20060823, and OpenBSD 3.8 and 3.9 before 20060902 allows remote attackers to cause a denial of service (panic), obtain sensitive information, and possibly execute arbitrary code via crafted Link Control Protocol (LCP) packets with an option length that exceeds the overall length, which triggers the overflow in (1) pppoe and (2) ippp. NOTE: this issue was originally incorrectly reported for the ppp driver. |
| CVE-2006-0905 | High | 2006-03-23 | Not applicable | No public exploit | A "programming error" in fast_ipsec in FreeBSD 4.8-RELEASE through 6.1-STABLE and NetBSD 2 through 3 does not properly update the sequence number associated with a Security Association, which allows packets to pass sequence number checks and allows remote attackers to capture IPSec packets and conduct replay attacks. |
| CVE-2005-4776 | High | 2005-12-31 | Not applicable | No public exploit | Integer overflow in the FreeBSD compatibility code (freebsd_misc.c) in NetBSD-current, NetBSD-3, NetBSD-2.0, and NetBSD-2 before 20050913; and NetBSD-1.6 before 20050914; allows local users to cause a denial of service (heap corruption or system crash) and possibly gain root privileges. |
| CVE-2005-4741 | High | 2005-12-31 | Not applicable | No public exploit | NetBSD 1.6, NetBSD 2.0 through 2.1, and NetBSD-current before 20051031 allows local users to gain privileges by attaching a debugger to a setuid/setgid (P_SUGID) process that performs an exec without a reset of real credentials. |
| CVE-2004-2012 | High | 2004-12-31 | Not applicable | Working exploit published | The systrace_exit function in the systrace utility for NetBSD-current and 2.0 before April 16, 2004, and certain FreeBSD ports, does not verify the owner of the /dec/systrace connection before setting euid to 0, which allows local users to gain root privileges. |
| CVE-2004-1374 | High | 2004-12-18 | Not applicable | No public exploit | Multiple buffer overflows in NetBSD kernel may allow local users to execute arbitrary code and gain privileges. |
| CVE-2003-0730 | High | 2003-10-20 | Not applicable | No public exploit | Multiple integer overflows in the font libraries for XFree86 4.3.0 allow local or remote attackers to cause a denial of service or execute arbitrary code via heap-based and stack-based buffer overflow attacks. |
| CVE-2003-0694 | High | 2003-10-06 | Not applicable | Exploited | The prescan function in Sendmail 8.12.9 allows remote attackers to execute arbitrary code via buffer overflow attacks, as demonstrated using the parseaddr function in parseaddr.c. |
| CVE-2003-0681 | High | 2003-10-06 | Not applicable | Exploited | A "potential buffer overflow in ruleset parsing" for Sendmail 8.12.9, when using the nonstandard rulesets (1) recipient (2), final, or (3) mailer-specific envelope recipients, has unknown consequences. |
| CVE-2002-1500 | High | 2003-04-02 | Not applicable | No public exploit | Buffer overflow in (1) mrinfo, (2) mtrace, and (3) pppd in NetBSD 1.4.x through 1.6 allows local users to gain privileges by executing the programs after filling the file descriptor tables, which produces file descriptors larger than FD_SETSIZE, which are not checked by FD_SET(). |
| CVE-2002-1337 | High | 2003-03-07 | Not applicable | Working exploit published | Buffer overflow in Sendmail 5.79 to 8.12.7 allows remote attackers to execute arbitrary code via certain formatted address fields, related to sender and recipient header comments as processed by the crackaddr function of headers.c. |
| CVE-2002-1194 | High | 2002-10-28 | Not applicable | No public exploit | Buffer overflow in talkd on NetBSD 1.6 and earlier, and possibly other operating systems, may allow remote attackers to execute arbitrary code via a long inbound message. |
| CVE-2002-0414 | High | 2002-08-12 | Not applicable | No public exploit | KAME-derived implementations of IPsec on NetBSD 1.5.2, FreeBSD 4.5, and other operating systems, does not properly consult the Security Policy Database (SPD), which could cause a Security Gateway (SG) that does not use Encapsulating Security Payload (ESP) to forward forged IPv4 packets. |
| CVE-2000-1208 | High | 2002-08-12 | Not applicable | No public exploit | Format string vulnerability in startprinting() function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges via an improper syslog call that uses format strings from the checkremote() call. |
| CVE-2002-0004 | High | 2002-02-27 | Not applicable | Working exploit published | Heap corruption vulnerability in the "at" program allows local users to execute arbitrary code via a malformed execution time, which causes at to free the same memory twice. |
| CVE-2001-0734 | High | 2001-10-18 | Not applicable | No public exploit | Hitachi Super-H architecture in NetBSD 1.5 and 1.4.1 allows a local user to gain privileges via modified Status Register contents, which are not properly handled by (1) the sigreturn system call or (2) the process_write_regs kernel routine. |
| CVE-2001-0670 | High | 2001-10-03 | Not applicable | No public exploit | Buffer overflow in BSD line printer daemon (in.lpd or lpd) in various BSD-based operating systems allows remote attackers to execute arbitrary code via an incomplete print job followed by a request to display the printer queue. |
| CVE-2001-1091 | High | 2001-08-23 | Not applicable | No public exploit | The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the RCMD_CMD environment variable. |
| CVE-2001-0554 | High | 2001-08-14 | Not applicable | Exploited | Buffer overflow in BSD-based telnetd telnet daemon on various operating systems allows remote attackers to execute arbitrary commands via a set of options including AYT (Are You There), which is not properly handled by the telrcv function. |
| CVE-2001-0247 | High | 2001-06-18 | Not applicable | Working exploit published | Buffer overflows in BSD-based FTP servers allows remote attackers to execute arbitrary commands via a long pattern string containing a {} sequence, as seen in (1) g_opendir, (2) g_lstat, (3) g_stat, and (4) the glob0 buffer as used in the glob functions glob2 and glob3. |
| CVE-2001-0268 | High | 2001-05-03 | Not applicable | No public exploit | The i386_set_ldt system call in NetBSD 1.5 and earlier, and OpenBSD 2.8 and earlier, when the USER_LDT kernel option is enabled, does not validate a call gate target, which allows local users to gain root privileges by creating a segment call gate in the Local Descriptor Table (LDT) with a target that specifies an arbitrary kernel address. |
| CVE-2001-0033 | High | 2001-02-16 | Not applicable | No public exploit | KTH Kerberos IV allows local users to change the configuration of a Kerberos server running at an elevated privilege by specifying an alternate directory using with the KRBCONFDIR environmental variable, which allows the user to gain additional privileges. |
| CVE-2001-0053 | High | 2001-02-12 | Not applicable | Working exploit published | One-byte buffer overflow in replydirname function in BSD-based ftpd allows remote attackers to gain root privileges. |
| CVE-2000-0997 | High | 2000-12-19 | Not applicable | No public exploit | Format string vulnerabilities in eeprom program in OpenBSD, NetBSD, and possibly other operating systems allows local attackers to gain root privileges. |
| CVE-2000-0993 | High | 2000-12-19 | Not applicable | Working exploit published | Format string vulnerability in pw_error function in BSD libutil library allows local users to gain root privileges via a malformed password in commands such as chpass or passwd. |
| CVE-2000-0751 | High | 2000-10-20 | Not applicable | Working exploit published | mopd (Maintenance Operations Protocol loader daemon) does not properly cleanse user-injected format strings, which allows remote attackers to execute arbitrary commands. |
| CVE-2000-0750 | High | 2000-10-20 | Not applicable | No public exploit | Buffer overflow in mopd (Maintenance Operations Protocol loader daemon) allows remote attackers to execute arbitrary commands via a long file name. |
| CVE-2000-0094 | High | 2000-02-16 | Not applicable | Working exploit published | procfs in BSD systems allows local users to gain root privileges by modifying the /proc/pid/mem interface via a modified file descriptor for stderr. |
| CVE-2000-0157 | High | 2000-02-01 | Not applicable | No public exploit | NetBSD ptrace call on VAX allows local users to gain privileges by modifying the PSL contents in the debugging process. |
| CVE-1999-0674 | High | 1999-08-09 | Not applicable | Working exploit published | The BSD profil system call allows a local user to modify the internal data space of a program via profiling and execve. |
| CVE-1999-0466 | High | 1999-04-21 | Not applicable | No public exploit | The SVR4 /dev/wabi special device file in NetBSD 1.3.3 and earlier allows a local user to read or write arbitrary files on the disk associated with that device. |
| CVE-1999-0434 | High | 1999-03-30 | Not applicable | No public exploit | XFree86 xfs command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service. |
| CVE-1999-0420 | High | 1999-03-17 | Not applicable | No public exploit | umapfs allows local users to gain root privileges by changing their uid through a malicious mount_umap program. |
| CVE-1999-0009 | High | 1998-04-08 | Not applicable | Working exploit published | Inverse query buffer overflow in BIND 4.9 and BIND 8 Releases. |
| CVE-1999-0323 | High | 1998-02-20 | Not applicable | No public exploit | FreeBSD mmap function allows users to modify append-only or immutable files. |
| CVE-1999-0304 | High | 1998-02-01 | Not applicable | No public exploit | mmap function in BSD allows local attackers in the kmem group to modify memory through devices. |
| CVE-1999-0017 | High | 1997-12-10 | Not applicable | No public exploit | FTP servers can allow an attacker to connect to arbitrary ports on machines other than the FTP client, aka FTP bounce. |
| CVE-1999-0046 | High | 1997-02-06 | Not applicable | Working exploit published | Buffer overflow of rlogin program using TERM environmental variable. |
| CVE-1999-0297 | High | 1996-12-12 | Not applicable | No public exploit | Buffer overflow in Vixie Cron library up to version 3.0 allows local users to obtain root access via a long environmental variable. |
| CVE-1999-0085 | High | 1996-08-21 | Not applicable | No public exploit | Buffer overflow in rwhod on AIX and other operating systems allows remote attackers to execute arbitrary code via a UDP packet with a long hostname. |