WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor smartbear✕
Overview 10 matches · 2 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
10matches 2in Waratek scope20.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC20.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 10.0% No exploit published 1 10.0% Outside Waratek scope 0 0.0% Not applicable 8 80.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 10 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 10 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 2 20.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 8 80.0%
split by peak 3 / year
Not applicable: 8No exploit published: 1Mitigation candidate: 1 High: 10 not blocked: 10 No public exploit: 8Working exploit published: 2
20141 Mitigation candidate1 High1 not blocked1 Working exploit published1 20150 20160 20170 20181 Not applicable1 High1 not blocked1 No public exploit1 20191 Not applicable1 High1 not blocked1 Working exploit published1 20201 Not applicable1 High1 not blocked1 No public exploit1 20212 No exploit published1 Not applicable1 High2 not blocked2 No public exploit2 20220 20233 Not applicable3 High3 not blocked3 No public exploit3 20241 Not applicable1 High1 not blocked1 No public exploit1
20142015201620172018201920202021202220232024
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2024-7565 High 2024-11-22 Not applicable No public exploit SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of SMARTBEAR SoapUI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the unpackageAll function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19060.
CVE-2023-22892 High 2023-03-08 Not applicable No public exploit There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arbitrary files from Zephyr instances.
CVE-2023-22891 High 2023-03-08 Not applicable No public exploit There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords for other accounts.
CVE-2023-22890 High 2023-03-08 Not applicable No public exploit SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, causing a denial of service condition.
CVE-2021-21363 High 2021-03-11 No exploit published No public exploit swagger-codegen is an open-source project which contains a template-driven engine to generate documentation, API clients and server stubs in different languages by parsing your OpenAPI / Swagger definition. In swagger-codegen before version 2.4.19, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the process of creating a temporary sub directory in the shared temporary directory and race to complete the creation of the temporary subdirectory. This vulnerability is local privilege escalation because the contents of the `outputFolder` can be appended to by an attacker. As such, code written to this directory, when executed can be attacker controlled. For more details refer to the referenced GitHub Security Advisory. This vulnerability is fixed in version 2.4.19. Note this is a distinct vulnerability from CVE-2021-21364.
CVE-2020-26118 High 2021-01-11 Not applicable No public exploit In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system.
CVE-2019-12180 High 2020-02-05 Not applicable No public exploit An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code (Java scripting language) on the victim machine by inducing it to open a malicious Project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project.
CVE-2018-20580 High 2019-05-03 Not applicable Working exploit published The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.
CVE-2017-16670 High 2018-02-19 Not applicable No public exploit The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file.
CVE-2014-1202 High 2014-01-25 Mitigation candidate Working exploit published The WSDL/WADL import functionality in SoapUI before 4.6.4 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file.