Snap Creator Framework
Vendor:
First CVE: Sep 21, 2016 · Active for 9 years
42
Total CVEs
More Total CVEs than 97% of tracked products
6.0
Avg CVEs / Year
Higher CVE frequency than 90% of tracked products
7.1
Avg CVSS
Higher Avg CVSS than 42% of tracked products
4.8%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Snap Creator Framework over time
Volume of CVEsAvg CVSS Base Score
First CVE
Sep 21, 2016
9 years ago
Most Recent CVE
Apr 14, 2022
1,562 days ago
CVE Severity & Scoring
Snap Creator Framework42 CVEs
45%
26%
26%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local1 (2.4%)
Network40 (95.2%)
Unknown0 (0.0%)
Physical1 (2.4%)
Adjacent Network0 (0.0%)
Attack Complexity
Low36 (85.7%)
High6 (14.3%)
Unknown0 (0.0%)
User Interaction
None34 (81.0%)
Unknown0 (0.0%)
Required8 (19.0%)
Privileges Required
Low5 (11.9%)
High1 (2.4%)
None36 (85.7%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (42 CVEs).
42 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-8735CRITICAL Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener | Apr 6, 2017 | 9.8 | 97 | YES | YES |
CVE-2020-11023MEDIUM In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's | Apr 29, 2020 | 6.1 | 95 | YES | YES |
CVE-2021-34429MEDIUM For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or byp | Jul 15, 2021 | 5.3 | 91 | NO | YES |
CVE-2020-11022MEDIUM In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append | Apr 29, 2020 | 6.1 | 83 | NO | YES |
CVE-2018-11784MEDIUM When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the | Oct 4, 2018 | 4.3 | 83 | NO | YES |
CVE-2021-28169MEDIUM For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB | Jun 9, 2021 | 5.3 | 74 | NO | YES |
CVE-2020-27223MEDIUM In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality | Feb 26, 2021 | 5.3 | 61 | NO | NO |
CVE-2017-7658CRITICAL In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers | Jun 26, 2018 | 9.8 | 41 | NO | NO |
CVE-2017-7657CRITICAL In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled | Jun 26, 2018 | 9.8 | 39 | NO | NO |
CVE-2020-13954MEDIUM By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting ( | Nov 12, 2020 | 6.1 | 38 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (42 CVEs).
CISA KEV
2 CVEs
4.8% of CVEs· 97th percentile
Metasploit
1 CVE
2.4% of CVEs· 96th percentile
Nuclei
4 CVEs
9.5% of CVEs· 97th percentile
ExploitDB
5 CVEs
11.9% of CVEs· 89th percentile
Social Chatter
Signals from CVEs in this product scope (42 CVEs).
Media Mentions
Signals from CVEs in this product scope (42 CVEs).
Top CNAs Publishing CVEs For Snap Creator Framework
Top CWEs
Versions
No cataloged versions.