WaratekVRT Sign in
Reset
More filters (2)
Columns
EPSS ≥ 0.5✕Vendor org.apache.kylin✕
Overview 2 matches · 1 exploited · 1 CISA KEV · 1 public PoC
2matches 1exploited50.0% 1CISA KEV50.0% 1public PoC50.0%
Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 2 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 50.0% No public exploit 0 0.0%
split by peak 1 / quarter
Protected by Waratek: 2 High: 2 blocked by ARMR today: 2 Forecast only: 1Exploited: 1
Q2 201 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 220 Q4 221 Protected by Waratek1 High1 blocked by ARMR today1 Forecast only1
Q2 20Q3 20Q4 20Q1 21Q2 21Q3 21Q4 21Q1 22Q2 22Q3 22Q4 22
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-43396 High 2022-12-30 Protected by Waratek Forecast only In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by controlling the kylin.engine.spark-cmd parameter of conf.
CVE-2020-1956 High 2020-05-22 Protected by Waratek Exploited Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation.