Overview 4 matches · 3 protected · 2 exploited · 0 CISA KEV · 3 EPSS ≥ 0.5
Protected by Waratek
3
75.0%
Rule in development
0
0.0%
Mitigation candidate
1
25.0%
No exploit published
0
0.0%
blocked by ARMR today
3
75.0%
partly blocked
0
0.0%
not blocked
1
25.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
2
50.0%
Working exploit published
2
50.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 2 / year
2015201620172018201920202021
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2021-22145 | Medium | 2021-07-21 | Mitigation candidate | Working exploit published | A memory disclosure vulnerability was identified in Elasticsearch 7.10.0 to 7.13.3 error reporting. A user with the ability to submit arbitrary queries to Elasticsearch could submit a malformed query that would result in an error message returned containing previously used portions of a data buffer. This buffer could contain sensitive information such as Elasticsearch documents or authentication details. |
| CVE-2021-34429 | Medium | 2021-07-15 | Protected by Waratek | Exploited | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5. |
| CVE-2015-5531 | Medium | 2015-08-17 | Protected by Waratek | Exploited | Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary files via unspecified vectors related to snapshot API calls. |
| CVE-2015-3337 | Medium | 2015-05-01 | Protected by Waratek | Working exploit published | Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin is enabled, allows remote attackers to read arbitrary files via unspecified vectors. |