WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product influxdb✕
Overview 4 matches · 1 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
4matches 1in Waratek scope25.0% 0protected0.0% 1exploited25.0% 0CISA KEV0.0% 1public PoC25.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 1 25.0% Outside Waratek scope 0 0.0% Not applicable 3 75.0% Withdrawn CVE 0 0.0%
Critical 2 50.0% High 1 25.0% Medium 1 25.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 4 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 25.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 3 75.0%
split by peak 1 / quarter
Not applicable: 3No exploit published: 1 Medium: 1High: 1Critical: 2 not blocked: 4 No public exploit: 3Exploited: 1
Q2 191 No exploit published1 High1 not blocked1 No public exploit1 Q3 190 Q4 190 Q1 201 Not applicable1 Medium1 not blocked1 No public exploit1 Q2 200 Q3 200 Q4 201 Not applicable1 Critical1 not blocked1 Exploited1 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 221 Not applicable1 Critical1 not blocked1 No public exploit1
Q3 19Q1 20Q3 20Q1 21Q3 21Q1 22Q3 22
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2022-36640 Critical 2022-09-02 Not applicable No public exploit influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization."
CVE-2019-20933 Critical 2020-11-19 Not applicable Exploited InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
CVE-2018-17572 Medium 2020-03-02 Not applicable No public exploit InfluxDB 0.9.5 has Reflected XSS in the Write Data module.
CVE-2019-10329 High 2019-05-31 No exploit published No public exploit Jenkins InfluxDB Plugin 1.21 and earlier stored credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.