Overview 30 matches · 1 in Waratek scope · 1 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
30matches
1in Waratek scope3.3%
1protected3.3%
0exploited0.0%
0CISA KEV0.0%
1public PoC3.3%
0EPSS ≥ 0.50.0%
Protected by Waratek
1
3.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
29
96.7%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
3.3%
partly blocked
0
0.0%
not blocked
29
96.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
1
3.3%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
29
96.7%
split by
peak 12 / quarter
Q3 121
Not applicable1
Medium1
not blocked1
No public exploit1
Q4 120
Q1 130
Q2 130
Q3 130
Q4 131
Not applicable1
Medium1
not blocked1
No public exploit1
Q1 148
Not applicable8
Medium8
not blocked8
No public exploit8
Q2 142
Protected by Waratek1
Not applicable1
Medium2
blocked by ARMR today1
not blocked1
Working exploit published1
No public exploit1
Q3 142
Not applicable2
Medium2
not blocked2
No public exploit2
Q4 140
Q1 150
Q2 150
Q3 150
Q4 150
Q1 160
Q2 160
Q3 160
Q4 160
Q1 1712
Not applicable12
Medium12
not blocked12
No public exploit12
Q2 171
Not applicable1
Medium1
not blocked1
No public exploit1
Q3 173
Not applicable3
Medium3
not blocked3
No public exploit3
Q3 12Q1 13Q3 13Q1 14Q3 14Q1 15Q3 15Q1 16Q3 16Q1 17Q3 17
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2014-4616 | Medium | 2017-08-24 | Not applicable | No public exploit | Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function. |
| CVE-2015-5203 | Medium | 2017-08-02 | Not applicable | No public exploit | Double free vulnerability in the jasper_image_stop_load function in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. |
| CVE-2015-5221 | Medium | 2017-07-25 | Not applicable | No public exploit | Use-after-free vulnerability in the mif_process_cmpt function in libjasper/mif/mif_cod.c in the JasPer JPEG-2000 library before 1.900.2 allows remote attackers to cause a denial of service (crash) via a crafted JPEG 2000 image file. |
| CVE-2016-9960 | Medium | 2017-06-06 | Not applicable | No public exploit | game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash). |
| CVE-2015-8010 | Medium | 2017-03-27 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the Classic-UI with the CSV export link and pagination feature in Icinga before 1.14 allows remote attackers to inject arbitrary web script or HTML via the query string to cgi-bin/status.cgi. |
| CVE-2016-9556 | Medium | 2017-03-23 | Not applicable | No public exploit | The IsPixelGray function in MagickCore/pixel-accessor.h in ImageMagick 7.0.3-8 allows remote attackers to cause a denial of service (out-of-bounds heap read) via a crafted image file. |
| CVE-2014-9845 | Medium | 2017-03-20 | Not applicable | No public exploit | The ReadDIBImage function in coders/dib.c in ImageMagick allows remote attackers to cause a denial of service (crash) via a corrupted dib file. |
| CVE-2014-9844 | Medium | 2017-03-20 | Not applicable | No public exploit | The ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted image file. |
| CVE-2014-9853 | Medium | 2017-03-17 | Not applicable | No public exploit | Memory leak in coders/rle.c in ImageMagick allows remote attackers to cause a denial of service (memory consumption) via a crafted rle file. |
| CVE-2017-5938 | Medium | 2017-03-15 | Not applicable | No public exploit | Cross-site scripting (XSS) vulnerability in the nav_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows remote attackers to inject arbitrary web script or HTML via the nav_data name. |
| CVE-2016-10069 | Medium | 2017-03-02 | Not applicable | No public exploit | coders/mat.c in ImageMagick before 6.9.4-5 allows remote attackers to cause a denial of service (application crash) via a mat file with an invalid number of frames. |
| CVE-2016-10068 | Medium | 2017-03-02 | Not applicable | No public exploit | The MSL interpreter in ImageMagick before 6.9.6-4 allows remote attackers to cause a denial of service (segmentation fault and application crash) via a crafted XML file. |
| CVE-2016-9436 | Medium | 2017-01-20 | Not applicable | No public exploit | parsetagx.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to a <i> tag. |
| CVE-2016-9435 | Medium | 2017-01-20 | Not applicable | No public exploit | The HTMLtagproc1 function in file.c in w3m before 0.5.3+git20161009 does not properly initialize values, which allows remote attackers to crash the application via a crafted html file, related to <dd> tags. |
| CVE-2016-5317 | Medium | 2017-01-20 | Not applicable | No public exploit | Buffer overflow in the PixarLogDecode function in libtiff.so in the PixarLogDecode function in libtiff 4.0.6 and earlier, as used in GNOME nautilus, allows attackers to cause a denial of service attack (crash) via a crafted TIFF file. |
| CVE-2016-5316 | Medium | 2017-01-20 | Not applicable | No public exploit | Out-of-bounds read in the PixarLogCleanup function in tif_pixarlog.c in libtiff 4.0.6 and earlier allows remote attackers to crash the application by sending a crafted TIFF image to the rgb2ycbcr tool. |
| CVE-2014-0481 | Medium | 2014-08-26 | Not applicable | No public exploit | The default configuration for the file upload handling system in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 uses a sequential file name generation process when a file with a conflicting name is uploaded, which allows remote attackers to cause a denial of service (CPU consumption) by unloading a multiple files with the same name. |
| CVE-2014-4258 | Medium | 2014-07-17 | Not applicable | No public exploit | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.5.37 and earlier and 5.6.17 and earlier allows remote authenticated users to affect confidentiality, integrity, and availability via vectors related to SRINFOSC. |
| CVE-2014-3004 | Medium | 2014-06-11 | Protected by Waratek | Working exploit published | The default configuration for the Xerces SAX Parser in Castor before 1.3.3 allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted XML document. |
| CVE-2014-1542 | Medium | 2014-06-11 | Not applicable | No public exploit | Buffer overflow in the Speex resampler in the Web Audio subsystem in Mozilla Firefox before 30.0 allows remote attackers to execute arbitrary code via vectors related to a crafted AudioBuffer channel count and sample rate. |
| CVE-2014-1502 | Medium | 2014-03-19 | Not applicable | No public exploit | The (1) WebGL.compressedTexImage2D and (2) WebGL.compressedTexSubImage2D functions in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to bypass the Same Origin Policy and render content in a different domain via unspecified vectors. |
| CVE-2014-1500 | Medium | 2014-03-19 | Not applicable | No public exploit | Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to cause a denial of service (resource consumption and application hang) via onbeforeunload events that trigger background JavaScript execution. |
| CVE-2014-1499 | Medium | 2014-03-19 | Not applicable | No public exploit | Mozilla Firefox before 28.0 and SeaMonkey before 2.25 allow remote attackers to spoof the domain name in the WebRTC (1) camera or (2) microphone permission prompt by triggering navigation at a certain time during generation of this prompt. |
| CVE-2014-1498 | Medium | 2014-03-19 | Not applicable | No public exploit | The crypto.generateCRMFRequest method in Mozilla Firefox before 28.0 and SeaMonkey before 2.25 does not properly validate a certain key type, which allows remote attackers to cause a denial of service (application crash) via vectors that trigger generation of a key that supports the Elliptic Curve ec-dual-use algorithm. |
| CVE-2014-0081 | Medium | 2014-02-20 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. |
| CVE-2011-4093 | Medium | 2014-02-10 | Not applicable | No public exploit | Integer overflow in inc/server.hpp in libnet6 (aka net6) before 1.3.14 might allow remote attackers to hijack connections and gain privileges as other users by making a large number of connections until the overflow occurs and an ID of another user is provided. |
| CVE-2014-1489 | Medium | 2014-02-06 | Not applicable | No public exploit | Mozilla Firefox before 27.0 does not properly restrict access to about:home buttons by script on other pages, which allows user-assisted remote attackers to cause a denial of service (session restore) via a crafted web site. |
| CVE-2014-1484 | Medium | 2014-02-06 | Not applicable | No public exploit | Mozilla Firefox before 27.0 on Android 4.2 and earlier creates system-log entries containing profile paths, which allows attackers to obtain sensitive information via a crafted application. |
| CVE-2013-5611 | Medium | 2013-12-11 | Not applicable | No public exploit | Mozilla Firefox before 26.0 does not properly remove the Application Installation doorhanger, which makes it easier for remote attackers to spoof a Web App installation site by controlling the timing of page navigation. |
| CVE-2012-0867 | Medium | 2012-07-18 | Not applicable | No public exploit | PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters. |