active iq performance analytics services CVEs

Look up CVE IDs Status Exploitation Severity

Reset

Overview 15 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5

15matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 2public PoC13.3% 0EPSS ≥ 0.50.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 6 40.0% Not applicable 9 60.0% Withdrawn CVE 0 0.0%

Critical 1 6.7% High 2 13.3% Medium 10 66.7% Low 2 13.3% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 15 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 0 0.0% Working exploit published 1 6.7% Proof of concept only 1 6.7% Forecast only 0 0.0% No public exploit 13 86.7%

split by StatusSeverityProtectionExploit maturity peak 5 / month

Jun 181 Not applicable1 Medium1 not blocked1 No public exploit1 Jul 180 Aug 180 Sep 182 Outside Waratek scope2 High1 Medium1 not blocked2 Working exploit published1 No public exploit1 Oct 180 Nov 180 Dec 181 Not applicable1 Medium1 not blocked1 No public exploit1 Jan 193 Outside Waratek scope2 Not applicable1 Medium2 Low1 not blocked3 Proof of concept only1 No public exploit2 Feb 190 Mar 195 Not applicable5 Critical1 High1 Medium3 not blocked5 No public exploit5 Apr 190 May 190 Jun 190 Jul 191 Outside Waratek scope1 Low1 not blocked1 No public exploit1 Aug 191 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 Sep 191 Not applicable1 Medium1 not blocked1 No public exploit1

Jul 18Sep 18Nov 18Jan 19Mar 19May 19Jul 19Sep 19

15 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2019-15902	Medium	2019-09-04	Not applicable	No public exploit	A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse of the upstream "x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()" commit reintroduced the Spectre vulnerability that it aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped.
CVE-2019-15098	Medium	2019-08-16	Outside Waratek scope	No public exploit	drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.
CVE-2018-20855	Low	2019-07-26	Outside Waratek scope	No public exploit	An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.
CVE-2019-7612	Critical	2019-03-25	Not applicable	No public exploit	A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message.
CVE-2019-7222	Medium	2019-03-21	Not applicable	No public exploit	The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.
CVE-2019-7221	High	2019-03-21	Not applicable	No public exploit	The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.
CVE-2019-6454	Medium	2019-03-21	Not applicable	No public exploit	An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).
CVE-2018-19985	Medium	2019-03-21	Not applicable	No public exploit	The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.
CVE-2018-16888	Medium	2019-01-14	Outside Waratek scope	No public exploit	It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.
CVE-2018-16866	Low	2019-01-11	Outside Waratek scope	No public exploit	An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.
CVE-2019-5489	Medium	2019-01-07	Not applicable	Proof of concept only	The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server.
CVE-2018-19039	Medium	2018-12-13	Not applicable	No public exploit	Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.
CVE-2018-16597	Medium	2018-09-21	Outside Waratek scope	No public exploit	An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.
CVE-2018-17182	High	2018-09-19	Outside Waratek scope	Working exploit published	An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.
CVE-2018-12099	Medium	2018-06-11	Not applicable	No public exploit	Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2019-15902

Medium

2019-09-04

Not applicable

No public exploit

A backporting error was discovered in the Linux stable/longterm kernel 4.4.x through 4.4.190, 4.9.x through 4.9.190, 4.14.x through 4.14.141, 4.19.x through 4.19.69, and 5.2.x through 5.2.11. Misuse of the upstream "x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()" commit reintroduced the Spectre vulnerability that it aimed to eliminate. This occurred because the backport process depends on cherry picking specific commits, and because two (correctly ordered) code lines were swapped.

CVE-2019-15098

Medium

2019-08-16

Outside Waratek scope

No public exploit

drivers/net/wireless/ath/ath6kl/usb.c in the Linux kernel through 5.2.9 has a NULL pointer dereference via an incomplete address in an endpoint descriptor.

CVE-2018-20855

Low

2019-07-26

Outside Waratek scope

No public exploit

An issue was discovered in the Linux kernel before 4.18.7. In create_qp_common in drivers/infiniband/hw/mlx5/qp.c, mlx5_ib_create_qp_resp was never initialized, resulting in a leak of stack memory to userspace.

CVE-2019-7612

Critical

2019-03-25

Not applicable

No public exploit

A sensitive data disclosure flaw was found in the way Logstash versions before 5.6.15 and 6.6.1 logs malformed URLs. If a malformed URL is specified as part of the Logstash configuration, the credentials for the URL could be inadvertently logged as part of the error message.

CVE-2019-7222

Medium

2019-03-21

Not applicable

No public exploit

The KVM implementation in the Linux kernel through 4.20.5 has an Information Leak.

CVE-2019-7221

High

2019-03-21

Not applicable

No public exploit

The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.

CVE-2019-6454

Medium

2019-03-21

Not applicable

No public exploit

An issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).

CVE-2018-19985

Medium

2019-03-21

Not applicable

No public exploit

The function hso_get_config_data in drivers/net/usb/hso.c in the Linux kernel through 4.19.8 reads if_num from the USB device (as a u8) and uses it to index a small array, resulting in an object out-of-bounds (OOB) read that potentially allows arbitrary read in the kernel address space.

CVE-2018-16888

Medium

2019-01-14

Outside Waratek scope

No public exploit

It was discovered systemd does not correctly check the content of PIDFile files before using it to kill processes. When a service is run from an unprivileged user (e.g. User field set in the service file), a local attacker who is able to write to the PIDFile of the mentioned service may use this flaw to trick systemd into killing other services and/or privileged processes. Versions before v237 are vulnerable.

CVE-2018-16866

Low

2019-01-11

Outside Waratek scope

No public exploit

An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.

CVE-2019-5489

Medium

2019-01-07

Not applicable

Proof of concept only

The mincore() implementation in mm/mincore.c in the Linux kernel through 4.19.13 allowed local attackers to observe page cache access patterns of other processes on the same system, potentially allowing sniffing of secret information. (Fixing this affects the output of the fincore program.) Limited remote exploitation may be possible, as demonstrated by latency differences in accessing public files from an Apache HTTP Server.

CVE-2018-19039

Medium

2018-12-13

Not applicable

No public exploit

Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.

CVE-2018-16597

Medium

2018-09-21

Outside Waratek scope

No public exploit

An issue was discovered in the Linux kernel before 4.8. Incorrect access checking in overlayfs mounts could be used by local attackers to modify or truncate files in the underlying filesystem.

CVE-2018-17182

High

2018-09-19

Outside Waratek scope

Working exploit published

An issue was discovered in the Linux kernel through 4.18.8. The vmacache_flush_all function in mm/vmacache.c mishandles sequence number overflows. An attacker can trigger a use-after-free (and possibly gain privileges) via certain thread creation, map, unmap, invalidation, and dereference operations.

CVE-2018-12099

Medium

2018-06-11

Not applicable

No public exploit

Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.