Overview 19 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 3 public PoC · 0 EPSS ≥ 0.5
19matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
3public PoC15.8%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
19
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
19
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
3
15.8%
Proof of concept only
2
10.5%
Forecast only
0
0.0%
No public exploit
14
73.7%
split by
peak 4 / year
20171
Not applicable1
Medium1
not blocked1
No public exploit1
20181
Not applicable1
High1
not blocked1
No public exploit1
20192
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
20202
Not applicable2
Critical1
High1
not blocked2
No public exploit2
20211
Not applicable1
High1
not blocked1
No public exploit1
20223
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
20234
Not applicable4
Critical1
High3
not blocked4
No public exploit4
20242
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
20253
Not applicable3
Medium3
not blocked3
Proof of concept only2
No public exploit1
201720182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-29157 | Medium | 2025-09-25 | Not applicable | No public exploit | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via accessing a non-existent endpoint/cart, the server returns a 404-error page exposing sensitive information including the Servlet name (default) and server version |
| CVE-2025-29156 | Medium | 2025-09-25 | Not applicable | Proof of concept only | Cross Site Scripting vulnerability in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via a crafted script to the /api/v3/pet |
| CVE-2025-29155 | Medium | 2025-09-25 | Not applicable | Proof of concept only | An issue in petstore v.1.0.7 allows a remote attacker to execute arbitrary code via the DELETE endpoint |
| CVE-2024-7565 | High | 2024-11-22 | Not applicable | No public exploit | SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of SMARTBEAR SoapUI. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the unpackageAll function. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-19060. |
| CVE-2024-22207 | Medium | 2024-01-15 | Not applicable | Working exploit published | fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `baseDir` set will lead to all files in the module's directory being exposed via http routes served by the module. The vulnerability is fixed in v2.1.0. Setting the `baseDir` option can also work around this vulnerability. |
| CVE-2023-22892 | High | 2023-03-08 | Not applicable | No public exploit | There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticated users to read arbitrary files from Zephyr instances. |
| CVE-2023-22891 | High | 2023-03-08 | Not applicable | No public exploit | There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users to reset passwords for other accounts. |
| CVE-2023-22890 | High | 2023-03-08 | Not applicable | No public exploit | SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, causing a denial of service condition. |
| CVE-2023-22889 | Critical | 2023-03-08 | Not applicable | No public exploit | SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. This could lead to remote code execution by unauthenticated users. |
| CVE-2021-46708 | Medium | 2022-03-11 | Not applicable | No public exploit | The swagger-ui-dist package before 4.1.3 for Node.js could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. |
| CVE-2018-25031 | Medium | 2022-03-11 | Not applicable | Working exploit published | Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others. |
| CVE-2021-41657 | Medium | 2022-03-10 | Not applicable | No public exploit | SmartBear CodeCollaborator v6.1.6102 was discovered to contain a vulnerability in the web UI which would allow an attacker to conduct a clickjacking attack. |
| CVE-2020-26118 | High | 2021-01-11 | Not applicable | No public exploit | In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit (GWT) API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious object can be submitted to the server via an authenticated attacker to execute commands on the underlying system. |
| CVE-2020-12835 | Critical | 2020-05-20 | Not applicable | No public exploit | An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration, an attacker can inject malicious serialized objects into the communication, resulting in remote code execution in the context of a client-side Network Licensing Protocol component. |
| CVE-2019-12180 | High | 2020-02-05 | Not applicable | No public exploit | An issue was discovered in SmartBear ReadyAPI through 2.8.2 and 3.0.0 and SoapUI through 5.5. When opening a project, the Groovy "Load Script" is automatically executed. This allows an attacker to execute arbitrary Groovy Language code (Java scripting language) on the victim machine by inducing it to open a malicious Project. The same issue is present in the "Save Script" function, which is executed automatically when saving a project. |
| CVE-2016-1000229 | Medium | 2019-12-20 | Not applicable | No public exploit | swagger-ui has XSS in key names |
| CVE-2018-20580 | High | 2019-05-03 | Not applicable | Working exploit published | The WSDL import functionality in SmartBear ReadyAPI 2.5.0 and 2.6.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL file. |
| CVE-2017-16670 | High | 2018-02-19 | Not applicable | No public exploit | The project import functionality in SoapUI 5.3.0 allows remote attackers to execute arbitrary Java code via a crafted request parameter in a WSDL project file. |
| CVE-2016-5682 | Medium | 2017-04-10 | Not applicable | No public exploit | Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section. |