WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor apache✕Product drill✕
Overview 8 matches · 5 in Waratek scope · 2 protected · 0 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
8matches 5in Waratek scope62.5% 2protected25.0% 0exploited0.0% 0CISA KEV0.0% 1public PoC12.5% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 3 37.5% Outside Waratek scope 1 12.5% Not applicable 2 25.0% Withdrawn CVE 0 0.0%
Critical 1 12.5% High 3 37.5% Medium 4 50.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 25.0% partly blocked 0 0.0% not blocked 6 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 12.5% Forecast only 0 0.0% No public exploit 7 87.5%
split by peak 3 / year
Not applicable: 2Outside Waratek scope: 1No exploit published: 3Protected by Waratek: 2 Medium: 4High: 3Critical: 1 not blocked: 6blocked by ARMR today: 2 No public exploit: 7Proof of concept only: 1
20141 Outside Waratek scope1 Medium1 not blocked1 No public exploit1 20150 20160 20171 No exploit published1 Medium1 not blocked1 No public exploit1 20180 20193 Protected by Waratek1 No exploit published2 High1 Medium2 blocked by ARMR today1 not blocked2 Proof of concept only1 No public exploit2 20200 20210 20220 20232 Not applicable2 High2 not blocked2 No public exploit2 20241 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1
20142015201620172018201920202021202220232024
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2023-48362 Critical 2024-07-24 Protected by Waratek No public exploit XXE in the XML Format Plugin in Apache Drill version 1.19.0 and greater allows a user to read any file on a remote file system or execute commands via a malicious XML file. Users are recommended to upgrade to version 1.21.2, which fixes this issue.
CVE-2023-39553 High 2023-08-11 Not applicable No public exploit Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider. Apache Airflow Drill Provider is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection with DrillHook giving an opportunity to read files on the Airflow server. This issue affects Apache Airflow Drill Provider: before 2.4.3. It is recommended to upgrade to a version that is not affected.
CVE-2023-28707 High 2023-04-07 Not applicable No public exploit Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2.
CVE-2019-14439 High 2019-07-30 Protected by Waratek Proof of concept only A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.
CVE-2019-0201 Medium 2019-05-23 No exploit published No public exploit An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves the ACLs of the requested node and returns all information contained in the ACL Id field as plaintext string. DigestAuthenticationProvider overloads the Id field with the hash value that is used for user authentication. As a consequence, if Digest Authentication is in use, the unsalted hash value will be disclosed by getACL() request for unauthenticated or unprivileged users.
CVE-2019-10241 Medium 2019-04-22 No exploit published No public exploit In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.
CVE-2017-12630 Medium 2017-12-18 No exploit published No public exploit In Apache Drill 1.11.0 and earlier when submitting form from Query page users are able to pass arbitrary script or HTML which will take effect on Profile page afterwards. Example: after submitting special script that returns cookie information from Query page, malicious user may obtain this information from Profile page afterwards.
CVE-2010-5312 Medium 2014-11-24 Outside Waratek scope No public exploit Cross-site scripting (XSS) vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option.