WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor elastic✕CISA KEV listed✕
Overview 3 matches · 2 in Waratek scope · 2 protected
3matches 2in Waratek scope66.7% 2protected66.7%
Protected by Waratek 2 66.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 1 33.3% Withdrawn CVE 0 0.0%
Critical 2 66.7% High 1 33.3% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 66.7% partly blocked 0 0.0% not blocked 1 33.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 3 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / quarter
Not applicable: 1Protected by Waratek: 2 High: 1Critical: 2 not blocked: 1blocked by ARMR today: 2 Exploited: 3
Q3 141 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Q4 140 Q1 151 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 Q2 150 Q3 150 Q4 150 Q1 160 Q2 160 Q3 160 Q4 160 Q1 170 Q2 170 Q3 170 Q4 170 Q1 180 Q2 180 Q3 180 Q4 180 Q1 191 Not applicable1 Critical1 not blocked1 Exploited1
Q3 14Q1 15Q3 15Q1 16Q3 16Q1 17Q3 17Q1 18Q3 18Q1 19
3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-7609 Critical 2019-03-25 Not applicable Exploited Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
CVE-2015-1427 Critical 2015-02-17 Protected by Waratek Exploited The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
CVE-2014-3120 High 2014-07-28 Protected by Waratek Exploited The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.