WaratekVRT Sign in

CWE-321 CVEs

6 CVEs, 1 exploited, 1 protected by Waratek

Reset
More filters (1)
Columns
CWE CWE-321✕
Overview 6 matches · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
6matches 0protected0.0% 1exploited16.7% 1CISA KEV16.7% 1public PoC16.7% 1EPSS ≥ 0.516.7%
Protected by Waratek 1 16.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 5 83.3%
Critical 3 50.0% High 2 33.3% Medium 1 16.7% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 1 16.7% not blocked 5 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 16.7% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 5 83.3%
split by peak 2 / year
No exploit published: 5Protected by Waratek: 1 Medium: 1High: 2Critical: 3 not blocked: 5partly blocked: 1 No public exploit: 5Exploited: 1
20121 No exploit published1 Medium1 not blocked1 No public exploit1 20130 20140 20150 20161 Protected by Waratek1 Critical1 partly blocked1 Exploited1 20170 20180 20190 20200 20210 20220 20230 20240 20252 No exploit published2 Critical1 High1 not blocked2 No public exploit2 20262 No exploit published2 Critical1 High1 not blocked2 No public exploit2
20122014201620182020202220242026
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-33266 High 2026-04-09 No exploit published No public exploit Use of Hard-coded Cryptographic Key vulnerability in Apache OpenMeetings. The remember-me cookie encryption key is set to default value in openmeetings.properties and not being auto-rotated. In case OM admin hasn't changed the default encryption key, an attacker who has stolen a cookie from a logged-in user can get full user credentials. This issue affects Apache OpenMeetings: from 6.1.0 before 9.0.0. Users are recommended to upgrade to version 9.0.0, which fixes the issue.
CVE-2025-14923 Critical 2026-03-03 No exploit published No public exploit IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.2 IBM WebSphere Application Server Liberty could provide weaker than expected security when using the Security Utility when administering security settings.
CVE-2025-54947 Critical 2025-12-12 No exploit published No public exploit In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the system uses a fixed, immutable key for encryption instead of dynamically generating or securely configuring the key. Attackers may obtain this key through reverse engineering or code analysis, potentially decrypting sensitive data or forging encrypted information, leading to information disclosure or unauthorized system access. This issue affects Apache StreamPark: from 2.0.0 before 2.1.7. Users are recommended to upgrade to version 2.1.7, which fixes the issue.
CVE-2025-65998 High 2025-11-24 No exploit published No public exploit Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values. This is not affecting encrypted plain attributes, whose values are also stored using AES encryption. Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.
CVE-2016-4437 Critical 2016-06-07 Protected by Waratek Exploited Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.
CVE-2011-5064 Medium 2012-01-14 No exploit published No public exploit DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.