Overview 64 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 9 public PoC · 3 EPSS ≥ 0.5
64matches
0in Waratek scope0.0%
0protected0.0%
1exploited1.6%
0CISA KEV0.0%
9public PoC14.1%
3EPSS ≥ 0.54.7%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
1
1.6%
Not applicable
63
98.4%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
64
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 24 / year
200413
Not applicable13
Medium13
not blocked13
Working exploit published3
No public exploit10
200524
Not applicable24
Medium24
not blocked24
Working exploit published3
No public exploit21
20063
Not applicable3
Medium3
not blocked3
No public exploit3
20074
Not applicable4
Medium4
not blocked4
No public exploit4
20082
Not applicable2
Medium2
not blocked2
No public exploit2
20090
20100
20114
Not applicable4
Medium4
not blocked4
No public exploit4
20124
Not applicable4
Medium4
not blocked4
Working exploit published1
No public exploit3
20133
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20142
Not applicable2
Medium2
not blocked2
No public exploit2
20151
Not applicable1
Medium1
not blocked1
No public exploit1
20160
20171
Not applicable1
Medium1
not blocked1
No public exploit1
20180
20190
20201
Not applicable1
Medium1
not blocked1
No public exploit1
20210
20220
20231
Outside Waratek scope1
Medium1
not blocked1
Exploited1
20240
20251
Not applicable1
Medium1
not blocked1
Proof of concept only1
20052007200920112013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2024-12086 | Medium | 2025-01-14 | Not applicable | Proof of concept only | A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client. |
| CVE-2023-48795 | Medium | 2023-12-18 | Outside Waratek scope | Exploited | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust. |
| CVE-2019-20384 | Medium | 2020-01-21 | Not applicable | No public exploit | Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners. |
| CVE-2017-14483 | Medium | 2017-09-15 | Not applicable | No public exploit | flower.initd in the Gentoo dev-python/flower package before 0.9.1-r1 for Celery Flower sets PID file ownership to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command. |
| CVE-2014-9622 | Medium | 2015-01-21 | Not applicable | No public exploit | Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open. |
| CVE-2014-4909 | Medium | 2014-07-29 | Not applicable | No public exploit | Integer overflow in the tr_bitfieldEnsureNthBitAlloced function in bitfield.c in Transmission before 2.84 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted peer message, which triggers an out-of-bounds write. |
| CVE-2013-4223 | Medium | 2014-05-23 | Not applicable | No public exploit | The Gentoo Nullmailer package before 1.11-r2 uses world-readable permissions for /etc/nullmailer/remotes, which allows local users to obtain SMTP authentication credentials by reading the file. |
| CVE-2013-2032 | Medium | 2013-11-18 | Not applicable | No public exploit | MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks. |
| CVE-2013-2031 | Medium | 2013-11-18 | Not applicable | No public exploit | MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox. |
| CVE-2010-1159 | Medium | 2013-10-28 | Not applicable | Working exploit published | Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet. |
| CVE-2012-4893 | Medium | 2012-09-11 | Not applicable | No public exploit | Multiple cross-site request forgery (CSRF) vulnerabilities in file/show.cgi in Webmin 1.590 and earlier allow remote attackers to hijack the authentication of privileged users for requests that (1) read files or execute (2) tar, (3) zip, or (4) gzip commands, a different issue than CVE-2012-2982. |
| CVE-2012-2983 | Medium | 2012-09-11 | Not applicable | No public exploit | file/edit_html.cgi in Webmin 1.590 and earlier does not perform an authorization check before showing a file's unedited contents, which allows remote attackers to read arbitrary files via the file field. |
| CVE-2012-2982 | Medium | 2012-09-11 | Not applicable | Working exploit published | file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character. |
| CVE-2012-2981 | Medium | 2012-09-11 | Not applicable | No public exploit | Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary Perl code via a crafted file associated with the type (aka monitor type name) parameter. |
| CVE-2011-1550 | Medium | 2011-03-30 | Not applicable | No public exploit | The default configuration of logrotate on SUSE openSUSE Factory uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories for the (1) cobbler, (2) inn, (3) safte-monitor, and (4) uucp packages. |
| CVE-2011-1549 | Medium | 2011-03-30 | Not applicable | No public exploit | The default configuration of logrotate on Gentoo Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by directories under /var/log/ for packages. |
| CVE-2011-1548 | Medium | 2011-03-30 | Not applicable | No public exploit | The default configuration of logrotate on Debian GNU/Linux uses root privileges to process files in directories that permit non-root write access, which allows local users to conduct symlink and hard link attacks by leveraging logrotate's lack of support for untrusted directories, as demonstrated by /var/log/postgresql/. |
| CVE-2011-1154 | Medium | 2011-03-30 | Not applicable | No public exploit | The shred_file function in logrotate.c in logrotate 3.7.9 and earlier might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a log filename, as demonstrated by a filename that is automatically constructed on the basis of a hostname or virtual machine name. |
| CVE-2008-4394 | Medium | 2008-10-10 | Not applicable | No public exploit | Multiple untrusted search path vulnerabilities in Portage before 2.1.4.5 include the current working directory in the Python search path, which allows local users to execute arbitrary code via a modified Python module that is loaded by the (1) ys-apps/portage, (2) net-mail/fetchmail, (3) app-editors/leo ebuilds, and other ebuilds. |
| CVE-2008-0386 | Medium | 2008-02-04 | Not applicable | No public exploit | Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email. |
| CVE-2007-5714 | Medium | 2007-10-30 | Not applicable | No public exploit | The Gentoo ebuild of MLDonkey before 2.9.0-r3 has a p2p user account with an empty default password and valid login shell, which might allow remote attackers to obtain login access and execute arbitrary code. |
| CVE-2007-3531 | Medium | 2007-07-25 | Not applicable | No public exploit | The set_default_speeds function in backend/backend.c in NVidia NVClock before 0.8b2 allows local users to overwrite arbitrary files via a symlink attack on the /tmp/nvclock temporary file. |
| CVE-2007-1500 | Medium | 2007-03-19 | Not applicable | No public exploit | The Linux Security Auditing Tool (LSAT) allows local users to overwrite arbitrary files via a symlink attack on temporary files, as demonstrated using /tmp/lsat1.lsat. |
| CVE-2007-0476 | Medium | 2007-01-25 | Not applicable | No public exploit | The gencert.sh script, when installing OpenLDAP before 2.1.30-r10, 2.2.x before 2.2.28-r7, and 2.3.x before 2.3.30-r2 as an ebuild in Gentoo Linux, does not create temporary directories in /tmp securely during emerge, which allows local users to overwrite arbitrary files via a symlink attack. |
| CVE-2006-3005 | Medium | 2006-06-13 | Not applicable | No public exploit | The JPEG library in media-libs/jpeg before 6b-r7 on Gentoo Linux is built without the -maxmem feature, which could allow context-dependent attackers to cause a denial of service (memory exhaustion) via a crafted JPEG file that exceeds the intended memory limits. |
| CVE-2006-1390 | Medium | 2006-03-25 | Not applicable | No public exploit | The configuration of NetHack 3.4.3-r1 and earlier, Falcon's Eye 1.9.4a and earlier, and Slash'EM 0.0.760 and earlier on Gentoo Linux allows local users in the games group to modify saved games files to execute arbitrary code via buffer overflows and overwrite arbitrary files via symlink attacks. |
| CVE-2006-0071 | Medium | 2006-01-04 | Not applicable | No public exploit | The ebuild for pinentry before 0.7.2-r2 on Gentoo Linux sets setgid bits for pinentry programs, which allows local users to read or overwrite arbitrary files as gid 0. |
| CVE-2005-3626 | Medium | 2005-12-31 | Not applicable | No public exploit | Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference. |
| CVE-2005-3624 | Medium | 2005-12-31 | Not applicable | No public exploit | The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows. |
| CVE-2005-3785 | Medium | 2005-11-23 | Not applicable | No public exploit | Second-order symlink vulnerability in eix-sync.in in Ebuild IndeX (eix) before 0.5.0_pre2 allows local users to overwrite arbitrary files via a symlink attack on the exi.X.sync temporary file, which is processed by the diff-eix program. |
| CVE-2005-2557 | Medium | 2005-09-28 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in view_all_set.php in Mantis 0.19.0a1 through 1.0.0a3 allows remote attackers to inject arbitrary web script or HTML via the dir parameter, as identified by bug#0005959, and a different vulnerability than CVE-2005-3090. |
| CVE-2005-1267 | Medium | 2005-06-10 | Not applicable | Working exploit published | The bgp_update_print function in tcpdump 3.x does not properly handle a -1 return value from the decode_prefix4 function, which allows remote attackers to cause a denial of service (infinite loop) via a crafted BGP packet. |
| CVE-2005-1707 | Medium | 2005-05-24 | Not applicable | Working exploit published | The fn_show_postinst function in Gentoo webapp-config before 1.10-r14 allows local users to overwrite arbitrary files via a symlink attack on the postinst.txt temporary file. |
| CVE-2005-1121 | Medium | 2005-05-02 | Not applicable | No public exploit | Format string vulnerability in the my_xlog function in lib.c for Oops! Proxy Server 1.5.23 and earlier, as called by the auth functions in the passwd_mysql and passwd_pgsql modules, may allow attackers to execute arbitrary code via a URL. |
| CVE-2005-0427 | Medium | 2005-05-02 | Not applicable | No public exploit | The ebuild of Webmin before 1.170-r3 on Gentoo Linux includes the encrypted root password in the miniserv.users file when building a tbz2 of the webmin package, which allows remote attackers to obtain and possibly crack the encrypted password. |
| CVE-2004-1174 | Medium | 2005-04-14 | Not applicable | No public exploit | direntry.c in Midnight Commander (mc) 4.5.55 and earlier allows attackers to cause a denial of service by "manipulating non-existing file handles." |
| CVE-2004-1093 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via "use of already freed memory." |
| CVE-2004-1092 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by causing mc to free unallocated memory. |
| CVE-2004-1091 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service by triggering a null dereference. |
| CVE-2004-1090 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service via "a corrupt section header." |
| CVE-2004-1009 | Medium | 2005-04-14 | Not applicable | No public exploit | Midnight commander (mc) 4.5.55 and earlier allows remote attackers to cause a denial of service (infinite loop) via unknown attack vectors. |
| CVE-2005-0470 | Medium | 2005-03-14 | Not applicable | No public exploit | Buffer overflow in wpa_supplicant before 0.2.7 allows remote attackers to cause a denial of service (segmentation fault) via invalid EAPOL-Key packet data. |
| CVE-2005-0667 | Medium | 2005-03-07 | Not applicable | No public exploit | Buffer overflow in Sylpheed before 1.0.3 and other versions before 1.9.5 allows remote attackers to execute arbitrary code via an e-mail message with certain headers containing non-ASCII characters that are not properly handled when the user replies to the message. |
| CVE-2004-1055 | Medium | 2005-03-01 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 2.6.0-pl2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the PmaAbsoluteUri parameter, (2) the zero_rows parameter in read_dump.php, (3) the confirm form, or (4) an error message generated by the internal phpMyAdmin parser. |
| CVE-2004-1036 | Medium | 2005-03-01 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the decoding of encoded text in certain headers in mime.php for SquirrelMail 1.4.3a and earlier, and 1.5.1-cvs before 23rd October 2004, allows remote attackers to execute arbitrary web script or HTML. |
| CVE-2004-1027 | Medium | 2005-03-01 | Not applicable | No public exploit | Directory traversal vulnerability in the -x (extract) command line option in unarj allows remote attackers to overwrite arbitrary files via an arj archive with filenames that contain .. (dot dot) sequences. |
| CVE-2004-0983 | Medium | 2005-03-01 | Not applicable | No public exploit | The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request. |
| CVE-2004-0930 | Medium | 2005-01-27 | Not applicable | No public exploit | The ms_fnmatch function in Samba 3.0.4 and 3.0.7 and possibly other versions allows remote authenticated users to cause a denial of service (CPU consumption) via a SAMBA request that contains multiple * (wildcard) characters. |
| CVE-2004-0918 | Medium | 2005-01-27 | Not applicable | No public exploit | The asn_parse_header function (asn1.c) in the SNMP module for Squid Web Proxy Cache before 2.4.STABLE7 allows remote attackers to cause a denial of service (server restart) via certain SNMP packets with negative length fields that trigger a memory allocation error. |
| CVE-2004-1167 | Medium | 2005-01-10 | Not applicable | No public exploit | mirrorselect before 0.89 creates temporary files in a world-writable location with predictable file names, which allows remote attackers to overwrite arbitrary files via a symlink attack. |
| CVE-2004-1106 | Medium | 2005-01-10 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in Gallery 1.4.4-pl3 and earlier allows remote attackers to execute arbitrary web script or HTML via "specially formed URLs," possibly via the include parameter in index.php. |
| CVE-2004-1901 | Medium | 2004-12-31 | Not applicable | No public exploit | Portage before 2.0.50-r3 allows local users to overwrite arbitrary files via a hard link attack on the lockfiles. |
| CVE-2004-1491 | Medium | 2004-12-31 | Not applicable | Working exploit published | Opera 7.54 and earlier uses kfmclient exec to handle unknown MIME types, which allows remote attackers to execute arbitrary code via a shortcut or launcher that contains an Exec entry. |
| CVE-2004-0749 | Medium | 2004-12-23 | Not applicable | No public exploit | The mod_authz_svn module in Subversion 1.0.7 and earlier does not properly restrict access to all metadata on unreadable paths, which could allow remote attackers to gain sensitive information via (1) svn log -v, (2) svn propget, or (3) svn blame, and other commands that follow renames. |
| CVE-2004-0635 | Medium | 2004-12-06 | Not applicable | No public exploit | The SNMP dissector in Ethereal 0.8.15 through 0.10.4 allows remote attackers to cause a denial of service (process crash) via a (1) malformed or (2) missing community string, which causes an out-of-bounds read. |
| CVE-2004-0634 | Medium | 2004-12-06 | Not applicable | No public exploit | The SMB SID snooping capability in Ethereal 0.9.15 to 0.10.4 allows remote attackers to cause a denial of service (process crash) via a handle without a policy name, which causes a null dereference. |
| CVE-2004-0633 | Medium | 2004-12-06 | Not applicable | Working exploit published | The iSNS dissector for Ethereal 0.10.3 through 0.10.4 allows remote attackers to cause a denial of service (process abort) via an integer overflow. |
| CVE-2004-0626 | Medium | 2004-12-06 | Not applicable | No public exploit | The tcp_find_option function of the netfilter subsystem in Linux kernel 2.6, when using iptables and TCP options rules, allows remote attackers to cause a denial of service (CPU consumption by infinite loop) via a large option length that produces a negative integer after a casting operation to the char type. |
| CVE-2004-0604 | Medium | 2004-12-06 | Not applicable | No public exploit | The HTTP client and server in giFT-FastTrack 0.8.6 and earlier allows remote attackers to cause a denial of service (crash), possibly via an empty search query, which triggers a NULL dereference. |
| CVE-2004-0809 | Medium | 2004-09-16 | Not applicable | No public exploit | The mod_dav module in Apache 2.0.50 and earlier allows remote attackers to cause a denial of service (child process crash) via a certain sequence of LOCK requests for a location that allows WebDAV authoring access. |
| CVE-2004-0232 | Medium | 2004-08-18 | Not applicable | No public exploit | Multiple format string vulnerabilities in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code. |
| CVE-2004-0229 | Medium | 2004-08-18 | Not applicable | No public exploit | The framebuffer driver in Linux kernel 2.6.x does not properly use the fb_copy_cmap function, with unknown impact. |
| CVE-2004-0493 | Medium | 2004-08-06 | Not applicable | Working exploit published | The ap_get_mime_headers_core function in Apache httpd 2.0.49 allows remote attackers to cause a denial of service (memory exhaustion), and possibly an integer signedness error leading to a heap-based buffer overflow on 64 bit systems, via long header lines with large numbers of space or tab characters. |
| CVE-2004-0417 | Medium | 2004-08-06 | Not applicable | No public exploit | Integer overflow in the "Max-dotdot" CVS protocol command (serve_max_dotdot) for CVS 1.12.x through 1.12.8, and 1.11.x through 1.11.16, may allow remote attackers to cause a server crash, which could cause temporary data to remain undeleted and consume disk space. |