WaratekVRT Sign in
Reset
More filters (2)
Columns
ARMR rules: SQL injection✕Published to 2022-01-31✕
Overview 10 matches · 0 exploited · 0 CISA KEV · 2 public PoC · 1 EPSS ≥ 0.5
10matches 0exploited0.0% 0CISA KEV0.0% 2public PoC20.0% 1EPSS ≥ 0.510.0%
Protected by Waratek 10 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 10 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 10 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 1 10.0% Proof of concept only 1 10.0% Forecast only 0 0.0% No public exploit 8 80.0%
split by peak 2 / quarter
Protected by Waratek: 10 Critical: 10 blocked by ARMR today: 10 No public exploit: 8Proof of concept only: 1Working exploit published: 1
Q3 161 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q4 160 Q1 171 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q2 171 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1 Q3 170 Q4 170 Q1 180 Q2 181 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q3 180 Q4 180 Q1 190 Q2 190 Q3 191 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q4 190 Q1 202 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 Q2 200 Q3 202 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 221 Protected by Waratek1 Critical1 blocked by ARMR today1 Proof of concept only1
Q3 16Q1 17Q3 17Q1 18Q3 18Q1 19Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-23305 Critical 2022-01-18 Protected by Waratek Proof of concept only By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. The message converter, %m, is likely to always be included. This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. Note this issue only affects Log4j 1.x when specifically configured to use the JDBCAppender, which is not the default. Beginning in version 2.0-beta8, the JDBCAppender was re-introduced with proper support for parameterized SQL queries and further customization over the columns written to in logs. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2020-13921 Critical 2020-08-05 Protected by Waratek No public exploit **Resolved** Only when using H2/MySQL/TiDB as Apache SkyWalking storage, there is a SQL injection vulnerability in the wildcard query cases.
CVE-2020-13926 Critical 2020-07-14 Protected by Waratek No public exploit Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.
CVE-2016-11024 Critical 2020-03-30 Protected by Waratek No public exploit odata4j 0.7.0 allows ExecuteJPQLQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
CVE-2016-11023 Critical 2020-03-30 Protected by Waratek No public exploit odata4j 0.7.0 allows ExecuteCountQueryCommand.java SQL injection. NOTE: this product is apparently discontinued.
CVE-2019-15563 Critical 2019-08-26 Protected by Waratek No public exploit Observational Health Data Sciences and Informatics (OHDSI) WebAPI before 2.7.2 allows SQL injection in FeatureExtractionService.java.
CVE-2018-1282 Critical 2018-04-05 Protected by Waratek No public exploit This vulnerability in Apache Hive JDBC driver 0.7.1 to 2.3.2 allows carefully crafted arguments to be used to bypass the argument escaping/cleanup that JDBC driver does in PreparedStatement implementation.
CVE-2017-3549 Critical 2017-04-24 Protected by Waratek Working exploit published Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affected are 12.1.1, 12.1.2, 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. Easily "exploitable" vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Scripting accessible data as well as unauthorized access to critical data or complete access to all Oracle Scripting accessible data. CVSS 3.0 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
CVE-2016-8027 Critical 2017-03-14 Protected by Waratek No public exploit SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attackers to alter a SQL query, which can result in disclosure of information within the database or impersonation of an agent without authentication via a specially crafted HTTP post.
CVE-2016-4999 Critical 2016-08-05 Protected by Waratek No public exploit SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.