debian debian linux

Published Atomicorp research notes for CVEs affecting debian debian linux where WAF protections were observed during testing or engineering review.

These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.

Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.

CVEVulnerabilityCVSSSeverityRules Observed
CVE-2021-44228Apache Log4j2 lookup feature JNDI injection (CVE-2021-44228)10.0 (v3.1)Critical345115 , 345117 , 345118 , 393655
CVE-2021-21345XStream < 1.4.16 - Remote Code Execution9.9 (v3.1)Critical344363 , 344366
CVE-2009-1151PhpMyAdmin Scripts - Remote Code Execution9.8 (v3.1)Critical340029 , 344360
CVE-2012-1823PHP-CGI Remote Code Execution (CVE-2012-1823)9.8 (v3.1)Critical340165 , 378491
CVE-2014-6271CUPS Filter Bash Environment Variable Code Injection (Shellshock)9.8 (v3.1)Critical330701 , 330791 , 340152 , 344360 , 390719 , 393134
CVE-2016-5771Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities9.8 (v3.1)Critical344365
CVE-2017-0372MediaWiki SyntaxHighlight extension option injection vulnerability9.8 (v3.0)Critical344370
CVE-2017-12629Apache Solr XML External Entity Injection (CVE-2017-12629)9.8 (v3.1)Critical344360 , 344363 , 344370 , 347009 , 380018 , 390722 , 392301
CVE-2017-7525Jackson-databind Deserialization Remote Command Execution (CVE-2017-7525)9.8 (v3.1)Critical340162 , 340163 , 344380
CVE-2018-7600Drupal Drupalgeddon 2 Forms API Property Injection9.8 (v3.1)Critical330791 , 340095 , 340152 , 390755
CVE-2019-11043PHP-FPM Path Info Buffer Underflow - Remote Code Execution9.8 (v3.1)Critical390714
CVE-2020-11984Apache HTTP Server - Remote Code Execution9.8 (v3.1)Critical344363 , 390614 , 390626 , 390724
CVE-2020-16846SaltStack Command Injection Remote Code Execution (CVE-2020-16846)9.8 (v3.1)Critical330791 , 340152 , 344364
CVE-2020-25592SaltStack Salt REST API Arbitrary Command Execution9.8 (v3.1)Critical330791 , 340152
CVE-2020-26935phpMyAdmin < 5.0.3 - SQL Injection9.8 (v3.1)Critical340016 , 340017 , 340157 , 341245 , 360147 , 360148
CVE-2020-8518Horde CSV import arbitrary PHP code execution9.8 (v3.1)Critical340128 , 344370 , 360152 , 380018 , 380026 , 390801
CVE-2020-9547FasterXML jackson-databind - Deserialization Remote Code Execution9.8 (v3.1)Critical398008
CVE-2020-9548FasterXML Jackson Databind <=2.9.10.4 - Remote Code Execution9.8 (v3.1)Critical398008
CVE-2021-25281SaltStack Salt API Unauthenticated RCE through wheel_async client9.8 (v3.1)Critical340007 , 340029 , 344360 , 344364 , 344370 , 390709
CVE-2025-24813Tomcat Session Deserialization Remote Code Execution (CVE-2025-24813)9.8 (v3.1)Critical392301
CVE-2021-21351XStream Deserialization Remote Command Execution (CVE-2021-21351)9.1 (v3.1)Critical344380
CVE-2021-25282SaltStack Salt API Unauthenticated RCE through wheel_async client9.1 (v3.1)Critical340007 , 340029 , 344360 , 344364 , 344370 , 390709
CVE-2021-40438Apache HTTP Server 2.4.48 mod_proxy SSRF (CVE-2021-40438)9.0 (v3.1)Critical345271 , 390723
CVE-2021-45046Apache Log4j2 - Remote Code Injection9.0 (v3.1)Critical345115 , 345117 , 345118 , 393655
CVE-2017-11610Supervisor XML-RPC Authenticated Remote Code Execution8.8 (v3.0)High344363 , 344364
CVE-2017-17405Ruby Net::FTP Module Command Injection (CVE-2017-17405)8.8 (v3.0)High393655
CVE-2018-12895Wordpress Arbitrary File Deletion8.8 (v3.1)High336461 , 340007 , 340748 , 344360 , 347006 , 381206 , 390709
CVE-2019-8942WordPress Crop-image Shell Upload8.8 (v3.0)High340006 , 340007 , 340029 , 340152 , 340748 , 344360 , 347006 , 347009 , 390709 , 390719
CVE-2019-9858Horde Form File Upload Vulnerability8.8 (v3.1)High340006 , 340007 , 344360 , 390709 , 390719
CVE-2020-26217XStream <1.4.14 - Remote Code Execution8.8 (v3.1)High344363 , 344366
CVE-2020-5504phpMyAdmin 5.0.0 - SQL Injection8.8 (v3.1)High340145 , 340156 , 341145 , 390727 , 392301 , 392648
CVE-2020-8163Ruby on Rails <5.0.1 - Remote Code Execution8.8 (v3.1)High340023 , 344360 , 344370 , 347009 , 390724
CVE-2020-8813Cacti v1.2.8 - Remote Code Execution8.8 (v3.1)High340014
CVE-2025-49113Roundcube Post-Auth RCE via PHP Object Deserialization8.8 (v3.1)High330791 , 334168 , 340128 , 340152 , 360152 , 380018 , 390700 , 390801
CVE-2021-39144XStream 1.4.18 - Remote Code Execution8.5 (v3.1)High344363
CVE-2017-12617Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1)8.1 (v3.1)High345493 , 392301
CVE-2017-15715Apache httpd <=2.4.29 - Arbitrary File Upload8.1 (v3.0)High344365
CVE-2017-16651Roundcube TimeZone Authenticated File Disclosure7.8 (v3.1)High340007 , 344360 , 390709
CVE-2018-19475GhostScript Sandbox Bypass Command Execution (CVE-2018-19475)7.8 (v3.0)High330791 , 340152
CVE-2021-22204GitLab Unauthenticated Remote ExifTool Command Injection7.8 (v3.1)High330791 , 334168 , 340152
CVE-2005-1921PHP XML-RPC Arbitrary Code Execution7.5 (v2.0)High344370 , 380026
CVE-2009-0255TYPO3 sa-2009-001 Weak Encryption Key File Disclosure7.5 (v3.1)High340007 , 344360 , 347009 , 390709
CVE-2013-0156Ruby on Rails XML Processor YAML Deserialization Scanner7.5 (v2.0)High340121 , 344363 , 344370 , 390635 , 398110
CVE-2014-3515Kerio Control Unified Threat Management 9.1.0 build 1087/9.1.1 build 1324 - Multiple Vulnerabilities7.5 (v2.0)High344365
CVE-2014-3704Drupal < 7.32 "Drupalgeddon" SQL Injection (CVE-2014-3704)7.5 (v2.0)High334168 , 340016 , 340095 , 340128 , 340145 , 340156 , 341145 , 341245 , 344366 , 346755 , 380018 , 380026 , 380122 , 390801 , 391235 , 392301
CVE-2015-1592SixApart MovableType Storable Perl Code Execution7.5 (v2.0)High340007 , 344360 , 344362 , 344366 , 344370 , 347009 , 380026 , 390709 , 390722
CVE-2016-0752Ruby on Rails Dynamic Render File Upload Remote Code Execution7.5 (v3.1)High330791 , 334168 , 340152
CVE-2018-14912cgit Directory Traversal7.5 (v3.0)High340007 , 344360 , 347009 , 390709
CVE-2018-19518PHP IMAP Remote Command Execution (CVE-2018-19518)7.5 (v3.1)High344361 , 344362 , 344363
CVE-2018-3760Ruby On Rails - Local File Inclusion7.5 (v3.0)High347009
CVE-2018-7490uWSGI PHP Plugin Local File Inclusion7.5 (v3.0)High347009
CVE-2019-5418Ruby on Rails Path Traversal and Arbitrary File Read (CVE-2019-5418)7.5 (v3.1)High340006 , 390719 , 398110
CVE-2022-21661WordPress Core 5.8.2 - 'WP_Query' SQL Injection7.5 (v3.1)High345493
CVE-2023-36661Ivanti Connect Secure Unauthenticated Remote Code Execution7.5 (v3.1)High337109 , 337110 , 398021 , 398022
CVE-2016-2098Ruby on Rails ActionPack Inline ERB Code Execution7.3 (v3.0)High330791 , 340095 , 340128 , 340152 , 346755 , 380018 , 392648
CVE-2024-2961CosmicSting: Magento Arbitrary File Read (CVE-2024-34102) + PHP Buffer Overflow in the iconv() function of glibc (CVE-2024-2961)7.3 (v3.1)High330791 , 340077 , 340152 , 341256 , 344370 , 344372 , 380018
CVE-2019-0193Apache Solr Remote Command Execution (CVE-2019-0193)7.2 (v3.1)High337209 , 337210 , 337211 , 340147 , 340148 , 341256 , 342259 , 344363 , 344370
CVE-2011-4350Yaws Web Server Directory Traversal6.5 (v3.1)Medium340006 , 344365 , 347019 , 390716
CVE-2017-11107phpLDAPadmin <= 1.2.3 - Reflected XSS6.1 (v3.1)Medium340147 , 341256 , 341266 , 342259 , 350148
CVE-2018-17082Apache2 - Transfer-Encoding Chunked XSS6.1 (v3.0)Medium392301
CVE-2019-10092Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting6.1 (v3.1)Medium344365
CVE-2021-30151Sidekiq <=6.2.0 - Cross-Site Scripting6.1 (v3.1)Medium346755
CVE-2021-33829Drupal 7 CKEditor XSS6.1 (v3.1)Medium333141
CVE-2017-17092WordPress < 4.9.1 - Authenticated JavaScript File Upload5.4 (v3.0)Medium377360
CVE-2014-5266Wordpress XMLRPC DoS5.0 (v2.0)Medium330791 , 340152 , 344372