secure backup CVEs · Critical

VRT Sign in

Look up CVE IDs Status Exploitation Severity

Reset

Overview 2 matches · 0 in Waratek scope · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC

2matches 0in Waratek scope0.0% 0protected0.0% 1exploited50.0% 1CISA KEV50.0% 1public PoC50.0%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 1 50.0% Not applicable 1 50.0% Withdrawn CVE 0 0.0%

Critical 2 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 50.0% No public exploit 0 0.0%

split by StatusSeverityProtectionExploit maturity peak 1 / month

Jun 211 Outside Waratek scope1 Critical1 not blocked1 Forecast only1 Jul 210 Aug 210 Sep 210 Oct 211 Not applicable1 Critical1 not blocked1 Exploited1

Jun 21Jul 21Aug 21Sep 21Oct 21

2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2021-42013	Critical	2021-10-07	Not applicable	Exploited	It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.
CVE-2021-26691	Critical	2021-06-10	Outside Waratek scope	Forecast only	In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2021-42013

Critical

2021-10-07

Not applicable

Exploited

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue only affects Apache 2.4.49 and Apache 2.4.50 and not earlier versions.

CVE-2021-26691

Critical

2021-06-10

Outside Waratek scope

Forecast only

In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow