WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product drill✕
Overview 12 matches · 6 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
12matches 6in Waratek scope50.0% 2protected16.7% 0exploited0.0% 0CISA KEV0.0% 1public PoC8.3% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 16.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 33.3% Outside Waratek scope 1 8.3% Not applicable 5 41.7% Withdrawn CVE 0 0.0%
Critical 1 8.3% High 4 33.3% Medium 7 58.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 16.7% partly blocked 0 0.0% not blocked 10 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 8.3% Forecast only 0 0.0% No public exploit 11 91.7%
split by peak 3 / year
Not applicable: 5Outside Waratek scope: 1No exploit published: 4Protected by Waratek: 2 Medium: 7High: 4Critical: 1 not blocked: 10blocked by ARMR today: 2 No public exploit: 11Proof of concept only: 1
20121 Not applicable1 Medium1 not blocked1 No public exploit1 20130 20141 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 20150 20160 20171 No exploit published1 Medium1 not blocked1 No public exploit1 20180 20193 Protected by Waratek1 No exploit published2 High1 Medium2 blocked by ARMR today1 not blocked2 Proof of concept only1 No public exploit2 20200 20210 20222 No exploit published1 Not applicable1 High1 Medium1 not blocked2 No public exploit2 20232 Not applicable2 High2 not blocked2 No public exploit2 20242 Protected by Waratek1 Not applicable1 Critical1 Medium1 blocked by ARMR today1 not blocked1 No public exploit2
2012201420162018202020222024
12 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-48362 Critical 2024-07-24 Protected by Waratek No public exploit XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.
CVE-2023-47828 Medium 2024-06-12 Not applicable No public exploit Missing Authorization vulnerability in Mandrill wpMandrill.This issue affects wpMandrill: from n/a through 1.33.
CVE-2023-39553 High 2023-08-11 Not applicable No public exploit Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server. This issue affects Apache Airflow Drill Provider: before 2.4.3. It is recommended to upgrade to a version that is not affected.
CVE-2023-28707 High 2023-04-07 Not applicable No public exploit Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2.
CVE-2022-4561 Medium 2022-12-16 Not applicable No public exploit A vulnerability classified as problematic has been found in SemanticDrilldown Extension. Affected is the function printFilterLine of the file includes/specials/SDBrowseDataPage.php of the component GET Parameter Handler. The manipulation of the argument value leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 6e18cf740a4548166c1d95f6d3a28541d298a3aa. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215964.
CVE-2022-23496 High 2022-12-08 No exploit published No public exploit Yet Another UserAgent Analyzer (Yauaa) is a java library that tries to parse and analyze the useragent string and extract as many relevant attributes as possible. Applications using the Client Hints analysis feature introduced with 7.0.0 can crash because the Yauaa library throws an ArrayIndexOutOfBoundsException. If uncaught the exception will result in a program crash. Applications that do not use this feature are not affected. Users are advised to upgrade to version 7.9.0. Users unable to upgrade may catch and discard any ArrayIndexOutOfBoundsException thrown by the Yauaa library.
CVE-2019-14439 High 2019-07-30 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2019-0201 Medium 2019-05-23 No exploit published No public exploit An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
CVE-2019-10241 Medium 2019-04-22 No exploit published No public exploit In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
CVE-2017-12630 Medium 2017-12-18 No exploit published No public exploit In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.
CVE-2010-5312 Medium 2014-11-24 Outside Waratek scope No public exploit Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.
CVE-2012-5544 Medium 2012-12-03 Not applicable No public exploit The Mandrill module 7.x-1.x before 7.x-1.2 for Drupal allows remote authenticated users to obtain password reset links by reading the logs in the Mandrill dashboard.