WaratekVRT Sign in

Payara CVEs with no public exploit

6 CVEs, 1 protected by Waratek

Reset
More filters (1)
Columns
Vendor payara✕
Overview 6 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
6matches 1protected16.7% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 16.7% Rule in development 0 0.0% Mitigation candidate 1 16.7% No exploit published 4 66.7%
Critical 1 16.7% High 3 50.0% Medium 2 33.3% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 16.7% partly blocked 0 0.0% not blocked 5 83.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 6 100.0%
split by peak 1 / quarter
No exploit published: 4Mitigation candidate: 1Protected by Waratek: 1 Medium: 2High: 3Critical: 1 not blocked: 5blocked by ARMR today: 1 No public exploit: 6
Q3 221 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q4 220 Q1 231 Mitigation candidate1 Critical1 not blocked1 No public exploit1 Q2 230 Q3 230 Q4 231 No exploit published1 Medium1 not blocked1 No public exploit1 Q1 240 Q2 240 Q3 241 No exploit published1 High1 not blocked1 No public exploit1 Q4 241 No exploit published1 High1 not blocked1 No public exploit1 Q1 250 Q2 251 No exploit published1 Medium1 not blocked1 No public exploit1
Q3 22Q4 22Q1 23Q2 23Q3 23Q4 23Q1 24Q2 24Q3 24Q4 24Q1 25Q2 25
6 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-1534 Medium 2025-04-01 No exploit published No public exploit CVE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Payara Platform Payara Server allows : Remote Code Inclusion.This issue affects Payara Server: from 4.1.2.1919.1 before 4.1.2.191.51, from 5.20.0 before 5.68.0, from 6.0.0 before 6.23.0, from 6.2022.1 before 6.2025.2.
CVE-2024-8215 High 2024-10-08 No exploit published No public exploit Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Payara Platform Payara Server (Admin Console modules) allows Remote Code Inclusion.This issue affects Payara Server: from 5.20.0 before 5.68.0, from 6.0.0 before 6.19.0, from 6.2022.1 before 6.2024.10, from 4.1.2.191.1 before 4.1.2.191.51.
CVE-2024-7312 High 2024-09-11 No exploit published No public exploit URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server (REST Management Interface modules) allows Session Hijacking.This issue affects Payara Server: from 6.0.0 before 6.18.0, from 6.2022.1 before 6.2024.9, from 5.2020.2 before 5.2022.5, from 5.20.0 before 5.67.0, from 4.1.2.191.0 before 4.1.2.191.50.
CVE-2023-41699 Medium 2023-11-15 No exploit published No public exploit URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows Redirect Access to Libraries.This issue affects Payara Server, Micro and Embedded: from 5.0.0 before 5.57.0, from 4.1.2.191 before 4.1.2.191.46, from 6.0.0 before 6.8.0, from 6.2023.1 before 6.2023.11.
CVE-2023-28462 Critical 2023-03-30 Mitigation candidate No public exploit A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 and newer (Community), when Java 1.8u181 and earlier is used, allows remote attackers to load malicious code on the server once a JNDI directory scan is performed.
CVE-2022-37422 High 2022-08-18 Protected by Waratek No public exploit Payara through 5.2022.2 allows directory traversal without authentication. This affects Payara Server, Payara Micro, and Payara Server Embedded.