WaratekVRT Sign in

Exploited Release CVEs

2 CVEs

Reset
More filters (1)
Columns
Product release✕
Overview 2 matches · 0 protected · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
2matches 0protected0.0% 0CISA KEV0.0% 1public PoC50.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 0 0.0% Rule in development 1 50.0% Mitigation candidate 1 50.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 2 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 2 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 100.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 0 0.0%
split by peak 1 / quarter
Mitigation candidate: 1Rule in development: 1 Medium: 2 not blocked: 2 Exploited: 2
Q1 241 Mitigation candidate1 Medium1 not blocked1 Exploited1 Q2 240 Q3 240 Q4 240 Q1 250 Q2 250 Q3 251 Rule in development1 Medium1 not blocked1 Exploited1
Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25Q3 25
2 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-4581 Medium 2025-08-09 Rule in development Exploited Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.15, 7.4 GA through update 92 allows a pre-authentication blind SSRF vulnerability in the portal-settings-authentication-opensso-web due to improper validation of user-supplied URLs. An attacker can exploit this issue to force the server to make arbitrary HTTP requests to internal systems, potentially leading to internal network enumeration or further exploitation.
CVE-2024-25608 Medium 2024-02-20 Mitigation candidate Exploited HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect.