WaratekVRT Sign in
Reset
More filters (2)
Columns
Vendor apache✕Product cassandra✕
Overview 4 matches · 1 exploited · 1 CISA KEV · 1 public PoC · 2 EPSS ≥ 0.5
4matches 1exploited25.0% 1CISA KEV25.0% 1public PoC25.0% 2EPSS ≥ 0.550.0%
Protected by Waratek 4 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 50.0% High 1 25.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 4 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 25.0% Working exploit published 1 25.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 50.0%
split by peak 1 / year
Protected by Waratek: 4 Medium: 1High: 1Critical: 2 blocked by ARMR today: 4 No public exploit: 2Working exploit published: 1Exploited: 1
20151 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 20161 Protected by Waratek1 Critical1 blocked by ARMR today1 Exploited1 20170 20180 20191 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20200 20210 20221 Protected by Waratek1 Critical1 blocked by ARMR today1 Working exploit published1
20152016201720182019202020212022
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-44521 Critical 2022-02-11 Protected by Waratek Working exploit published When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe, and will continue to be considered unsafe after this CVE.
CVE-2019-2684 Medium 2019-04-23 Protected by Waratek No public exploit Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
CVE-2016-3427 Critical 2016-04-21 Protected by Waratek Exploited Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
CVE-2015-0225 High 2015-04-03 Protected by Waratek No public exploit The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.