WaratekVRT Sign in

Exploited Elastic CVEs

2 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
Vendor elastic✕
Overview 2 matches
2matches
Protected by Waratek 2 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 1 50.0% High 1 50.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / month
Protected by Waratek: 2 High: 1Critical: 1 blocked by ARMR today: 2 Exploited: 2
Jul 141 Protected by Waratek1 High1 blocked by ARMR today1 Exploited1 Aug 140 Sep 140 Oct 140 Nov 140 Dec 140 Jan 150 Feb 151 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1
Jul 14Aug 14Sep 14Oct 14Nov 14Dec 14Jan 15Feb 15
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2015-1427 Critical 2015-02-17 Protected by Waratek Exploited The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
CVE-2014-3120 High 2014-07-28 Protected by Waratek Exploited The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to _search. NOTE: this only violates the vendor's intended security policy if the user does not run Elasticsearch in its own independent virtual machine.