WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Product nginx controller✕
Overview 11 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
11matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 2 18.2% Not applicable 9 81.8% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 11 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 11 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 11 100.0%
split by peak 4 / month
Not applicable: 9Outside Waratek scope: 2 High: 11 not blocked: 11 No public exploit: 11
Mar 201 Outside Waratek scope1 High1 not blocked1 No public exploit1 Apr 202 Outside Waratek scope1 Not applicable1 High2 not blocked2 No public exploit2 May 202 Not applicable2 High2 not blocked2 No public exploit2 Jun 200 Jul 204 Not applicable4 High4 not blocked4 No public exploit4 Aug 200 Sep 200 Oct 200 Nov 200 Dec 200 Jan 210 Feb 210 Mar 210 Apr 210 May 210 Jun 212 Not applicable2 High2 not blocked2 No public exploit2
Apr 20Jun 20Aug 20Oct 20Dec 20Feb 21Apr 21Jun 21
11 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2021-23019 High 2021-06-01 Not applicable No public exploit The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included in the NGINX support package.
CVE-2021-23018 High 2021-06-01 Not applicable No public exploit Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protocols inside the cluster.
CVE-2020-5911 High 2020-07-02 Not applicable No public exploit In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.
CVE-2020-5910 High 2020-07-02 Not applicable No public exploit In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5900 High 2020-07-01 Not applicable No public exploit In versions 3.0.0-3.4.0, 2.0.0-2.9.0, and 1.0.1, there is insufficient cross-site request forgery (CSRF) protections for the NGINX Controller user interface.
CVE-2020-5899 High 2020-07-01 Not applicable No public exploit In NGINX Controller 3.0.0-3.4.0, recovery code required to change a user's password is transmitted and stored in the database in plain text, which allows an attacker who can intercept the database connection or have read access to the database, to request a password reset using the email address of another registered user then retrieve the recovery code.
CVE-2020-5895 High 2020-05-07 Not applicable No public exploit On NGINX Controller versions 3.1.0-3.3.0, AVRD uses world-readable and world-writable permissions on its socket, which allows processes or users on the local system to write arbitrary data into the socket. A local system attacker can make AVRD segmentation fault (SIGSEGV) by writing malformed messages to the socket.
CVE-2020-5894 High 2020-05-07 Not applicable No public exploit On versions 3.0.0-3.3.0, the NGINX Controller webserver does not invalidate the server-side session token after users log out.
CVE-2020-5867 High 2020-04-23 Outside Waratek scope No public exploit In versions prior to 3.3.0, the NGINX Controller Agent installer script 'install.sh' uses HTTP instead of HTTPS to check and install packages
CVE-2020-5864 High 2020-04-23 Not applicable No public exploit In versions of NGINX Controller prior to 3.2.0, communication between NGINX Controller and NGINX Plus instances skip TLS verification by default.
CVE-2020-5863 High 2020-03-27 Outside Waratek scope No public exploit In NGINX Controller versions prior to 3.2.0, an unauthenticated attacker with network access to the Controller API can create unprivileged user accounts. The user which is created is only able to upload a new license to the system but cannot view or modify any other components of the system.