WaratekVRT Sign in

Exploited CWE-610 CVEs

2 CVEs

Reset
More filters (1)
Columns
CWE CWE-610✕
Overview 2 matches · 0 protected · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
2matches 0protected0.0% 0CISA KEV0.0% 1public PoC50.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 2 100.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 2 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / month
Mitigation candidate: 2 Medium: 2 not blocked: 2 Exploited: 2
Aug 201 Mitigation candidate1 Medium1 not blocked1 Exploited1 Sep 200 Oct 200 Nov 200 Dec 200 Jan 210 Feb 210 Mar 210 Apr 210 May 210 Jun 210 Jul 211 Mitigation candidate1 Medium1 not blocked1 Exploited1
Aug 20Sep 20Oct 20Nov 20Dec 20Jan 21Feb 21Mar 21Apr 21May 21Jun 21Jul 21
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-26920 Medium 2021-07-02 Mitigation candidate Exploited In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource.
CVE-2020-5412 Medium 2020-08-07 Mitigation candidate Exploited Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.