WaratekVRT Sign in
Reset
More filters (1)
Columns
Vendor org.apache.tika✕
Overview 4 matches · 1 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
4matches 1exploited25.0% 0CISA KEV0.0% 2public PoC50.0% 1EPSS ≥ 0.525.0%
Protected by Waratek 4 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 4 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 25.0% Working exploit published 0 0.0% Proof of concept only 1 25.0% Forecast only 0 0.0% No public exploit 2 50.0%
split by peak 1 / month
Protected by Waratek: 4 High: 4 blocked by ARMR today: 4 No public exploit: 2Proof of concept only: 1Exploited: 1
Sep 171 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Oct 170 Nov 170 Dec 170 Jan 180 Feb 180 Mar 180 Apr 181 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 May 180 Jun 180 Jul 180 Aug 180 Sep 181 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 Oct 181 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1
Oct 17Dec 17Feb 18Apr 18Jun 18Aug 18Oct 18
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2018-11796 High 2018-10-09 Protected by Waratek No public exploit In Apache Tika 1.19 (CVE-2018-11761), we added an entity expansion limit for XML parsing. However, Tika reuses SAXParsers and calls reset() after each parse, which, for Xerces2 parsers, as per the documentation, removes the user-specified SecurityManager and thus removes entity expansion limits after the first parse. Apache Tika versions from 0.1 to 1.19 are therefore still vulnerable to entity expansions which can lead to a denial of service attack. Users should upgrade to 1.19.1 or later.
CVE-2018-11761 High 2018-09-19 Protected by Waratek Proof of concept only In Apache Tika 0.1 to 1.18, the XML parsers were not configured to limit entity expansion. They were therefore vulnerable to an entity expansion vulnerability which can lead to a denial of service attack.
CVE-2018-1335 High 2018-04-25 Protected by Waratek Exploited From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients. The mitigation is to upgrade to Tika 1.18.
CVE-2016-4434 High 2017-09-30 Protected by Waratek No public exploit Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity (XXE) attacks via vectors involving (1) spreadsheets in OOXML files and (2) XMP metadata in PDF and other file formats, a related issue to CVE-2016-2175.