Overview 5 matches · 1 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
Protected by Waratek
5
100.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
5
100.0%
partly blocked
0
0.0%
not blocked
0
0.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
1
20.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
1
20.0%
No public exploit
3
60.0%
split by
peak 2 / quarter
Q1 201
Protected by Waratek1
High1
blocked by ARMR today1
No public exploit1
Q2 200
Q3 202
Protected by Waratek2
Critical2
blocked by ARMR today2
Exploited1
No public exploit1
Q4 200
Q1 210
Q2 210
Q3 210
Q4 210
Q1 220
Q2 220
Q3 220
Q4 222
Protected by Waratek2
Critical2
blocked by ARMR today2
Forecast only1
No public exploit1
Q1 20Q2 20Q3 20Q4 20Q1 21Q2 21Q3 21Q4 21Q1 22Q2 22Q3 22Q4 22
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2022-44621 | Critical | 2022-12-30 | Protected by Waratek | No public exploit | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. |
| CVE-2022-24697 | Critical | 2022-10-13 | Protected by Waratek | Forecast only | Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier. |
| CVE-2020-13926 | Critical | 2020-07-14 | Protected by Waratek | No public exploit | Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0. |
| CVE-2020-13925 | Critical | 2020-07-14 | Protected by Waratek | Exploited | Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0. |
| CVE-2020-1937 | High | 2020-02-24 | Protected by Waratek | No public exploit | Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries. |