WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-77✕
Overview 14 matches · 4 in Waratek scope · 4 protected · 0 exploited · 0 CISA KEV · 0 public PoC
14matches 4in Waratek scope28.6% 4protected28.6% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0%
Protected by Waratek 4 28.6% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 10 71.4% Withdrawn CVE 0 0.0%
Critical 2 14.3% High 10 71.4% Medium 2 14.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 28.6% partly blocked 0 0.0% not blocked 10 71.4% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 14 100.0% No public exploit 0 0.0%
split by peak 4 / quarter
Not applicable: 10Protected by Waratek: 4 Medium: 2High: 10Critical: 2 not blocked: 10blocked by ARMR today: 4 Forecast only: 14
Q1 201 Not applicable1 High1 not blocked1 Forecast only1 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 212 Not applicable2 High2 not blocked2 Forecast only2 Q1 221 Protected by Waratek1 Critical1 blocked by ARMR today1 Forecast only1 Q2 220 Q3 220 Q4 224 Protected by Waratek2 Not applicable2 Critical1 High3 blocked by ARMR today2 not blocked2 Forecast only4 Q1 231 Not applicable1 Medium1 not blocked1 Forecast only1 Q2 231 Protected by Waratek1 High1 blocked by ARMR today1 Forecast only1 Q3 231 Not applicable1 High1 not blocked1 Forecast only1 Q4 231 Not applicable1 High1 not blocked1 Forecast only1 Q1 241 Not applicable1 High1 not blocked1 Forecast only1 Q2 240 Q3 240 Q4 240 Q1 250 Q2 251 Not applicable1 Medium1 not blocked1 Forecast only1
Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25
14 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-4443 Medium 2025-05-09 Not applicable Forecast only A vulnerability was found in D-Link DIR-605L 2.13B01. It has been rated as critical. This issue affects the function sub_454F2C. The manipulation of the argument sysCmd leads to command injection. The attack may be initiated remotely. The vendor was contacted early about this disclosure. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2024-0507 High 2024-01-16 Not applicable Forecast only An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. This vulnerability affected all versions of GitHub Enterprise Server and was fixed in versions 3.11.3, 3.10.5, 3.9.8, and 3.8.13 This vulnerability was reported via the GitHub Bug Bounty program.
CVE-2023-42326 High 2023-11-14 Not applicable Forecast only An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.
CVE-2023-32782 High 2023-08-09 Not applicable Forecast only A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2023-32007 High 2023-05-02 Protected by Waratek Forecast only ** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This issue was disclosed earlier as CVE-2022-33891, but incorrectly claimed version 3.1.3 (which has since gone EOL) would not be affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Users are recommended to upgrade to a supported version of Apache Spark, such as version 3.4.0.
CVE-2023-28425 Medium 2023-03-20 Not applicable Forecast only Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10.
CVE-2022-43396 High 2022-12-30 Protected by Waratek Forecast only In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
CVE-2022-40770 High 2022-11-23 Not applicable Forecast only Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users.
CVE-2022-42904 High 2022-11-18 Not applicable Forecast only Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.
CVE-2022-24697 Critical 2022-10-13 Protected by Waratek Forecast only Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
CVE-2021-45456 Critical 2022-01-06 Protected by Waratek Forecast only Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps, resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.
CVE-2021-42132 High 2021-12-07 Not applicable Forecast only A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.
CVE-2021-42129 High 2021-12-07 Not applicable Forecast only A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.
CVE-2019-16012 High 2020-03-19 Not applicable Forecast only A vulnerability in the web UI of Cisco SD-WAN Solution vManage software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web UI improperly validates SQL values. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on, or return values from, the underlying database as well as the operating system.