WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Vendor clickhouse✕
Overview 9 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
9matches 0in Waratek scope0.0% 0protected0.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0% Outside Waratek scope 0 0.0% Not applicable 9 100.0% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 9 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 9 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 11.1% Forecast only 0 0.0% No public exploit 8 88.9%
split by peak 3 / quarter
Not applicable: 9 Medium: 9 not blocked: 9 No public exploit: 8Proof of concept only: 1
Q3 191 Not applicable1 Medium1 not blocked1 No public exploit1 Q4 192 Not applicable2 Medium2 not blocked2 No public exploit2 Q1 200 Q2 200 Q3 200 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 223 Not applicable3 Medium3 not blocked3 No public exploit3 Q2 220 Q3 220 Q4 220 Q1 230 Q2 230 Q3 230 Q4 231 Not applicable1 Medium1 not blocked1 No public exploit1 Q1 241 Not applicable1 Medium1 not blocked1 Proof of concept only1 Q2 240 Q3 240 Q4 240 Q1 250 Q2 251 Not applicable1 Medium1 not blocked1 No public exploit1
Q4 19Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25
9 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-1386 Medium 2025-04-11 Not applicable No public exploit When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream.
CVE-2024-22412 Medium 2024-03-18 Not applicable Proof of concept only ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles. In affected versions, the query cache only respects separate users, however this is not documented and not expected behavior. People relying on ClickHouse roles can have their access control lists bypassed if they are using query caching. Attackers who have control of a role could guess queries and see data they shouldn't have access to. Version 24.1 of ClickHouse and version 24.0.2.54535 of ClickHouse Cloud contain a patch for this issue. Based on the documentation, role based access control should be enforced regardless if query caching is enabled or not.
CVE-2022-44011 Medium 2023-11-23 Not applicable No public exploit An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability to load data) could cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19.
CVE-2021-42391 Medium 2022-03-14 Not applicable No public exploit Divide-by-zero in Clickhouse's Gorilla compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
CVE-2021-42390 Medium 2022-03-14 Not applicable No public exploit Divide-by-zero in Clickhouse's DeltaDouble compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
CVE-2021-42389 Medium 2022-03-14 Not applicable No public exploit Divide-by-zero in Clickhouse's Delta compression codec when parsing a malicious query. The first byte of the compressed buffer is used in a modulo operation without being checked for 0.
CVE-2019-15024 Medium 2019-12-30 Not applicable No public exploit In all versions of ClickHouse before 19.14.3, an attacker having write access to ZooKeeper and who is able to run a custom server available from the network where ClickHouse runs, can create a custom-built malicious server that will act as a ClickHouse replica and register it in ZooKeeper. When another replica will fetch data part from the malicious replica, it can force clickhouse-server to write to arbitrary path on filesystem.
CVE-2019-18657 Medium 2019-10-31 Not applicable No public exploit ClickHouse before 19.13.5.44 allows HTTP header injection via the url table function.
CVE-2018-14672 Medium 2019-08-15 Not applicable No public exploit In ClickHouse before 18.12.13, functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages.