Process Automation CVEs
24 CVEs, 3 exploited, 6 protected by Waratek
Overview 24 matches · 6 protected · 3 exploited · 2 CISA KEV · 4 public PoC · 3 EPSS ≥ 0.5
Protected by Waratek
6
25.0%
Rule in development
0
0.0%
Mitigation candidate
2
8.3%
No exploit published
16
66.7%
blocked by ARMR today
6
25.0%
partly blocked
0
0.0%
not blocked
18
75.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
3
12.5%
Working exploit published
0
0.0%
Proof of concept only
2
8.3%
Forecast only
0
0.0%
No public exploit
19
79.2%
split by
peak 5 / year
20205
Protected by Waratek1
No exploit published4
Critical1
High3
Medium1
blocked by ARMR today1
not blocked4
No public exploit5
20215
Protected by Waratek3
No exploit published2
Critical1
High2
Medium2
blocked by ARMR today3
not blocked2
Exploited2
No public exploit3
20224
Protected by Waratek1
Mitigation candidate1
No exploit published2
High3
Medium1
blocked by ARMR today1
not blocked3
Proof of concept only1
No public exploit3
20234
Protected by Waratek1
Mitigation candidate1
No exploit published2
High4
blocked by ARMR today1
not blocked3
Exploited1
No public exploit3
20241
No exploit published1
High1
not blocked1
No public exploit1
20251
No exploit published1
High1
not blocked1
No public exploit1
20264
No exploit published4
Critical4
not blocked4
Proof of concept only1
No public exploit3
2020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-28369 | Critical | 2026-03-27 | No exploit published | No public exploit | A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure. |
| CVE-2026-28368 | Critical | 2026-03-27 | No exploit published | No public exploit | A flaw was found in Undertow. This vulnerability allows a remote attacker to construct specially crafted requests where header names are parsed differently by Undertow compared to upstream proxies. This discrepancy in header interpretation can be exploited to launch request smuggling attacks, potentially bypassing security controls and accessing unauthorized resources. |
| CVE-2026-28367 | Critical | 2026-03-27 | No exploit published | No public exploit | A flaw was found in Undertow. A remote attacker can exploit this vulnerability by sending `\r\r\r` as a header block terminator. This can be used for request smuggling with certain proxy servers, such as older versions of Apache Traffic Server and Google Cloud Classic Application Load Balancer, potentially leading to unauthorized access or manipulation of web requests. |
| CVE-2025-12543 | Critical | 2026-01-07 | No exploit published | Proof of concept only | A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a result, requests containing malformed or malicious Host headers are processed without rejection, enabling attackers to poison caches, perform internal network scans, or hijack user sessions. |
| CVE-2025-9784 | High | 2025-09-02 | No exploit published | No public exploit | A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters. This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts. While not a protocol bug, this highlights a common implementation weakness that can be exploited to cause a denial of service (DoS). |
| CVE-2024-7885 | High | 2024-08-21 | No exploit published | No public exploit | A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments. |
| CVE-2023-44487 | High | 2023-10-10 | Mitigation candidate | Exploited | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
| CVE-2023-4853 | High | 2023-09-20 | No exploit published | No public exploit | A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service. |
| CVE-2023-1108 | High | 2023-09-14 | No exploit published | No public exploit | A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. |
| CVE-2022-1415 | High | 2023-09-11 | Protected by Waratek | No public exploit | A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server. |
| CVE-2019-14841 | High | 2022-10-17 | No exploit published | No public exploit | A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to gain admin privileges in the Business Central Console. |
| CVE-2021-4178 | Medium | 2022-08-24 | Protected by Waratek | No public exploit | A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML. |
| CVE-2019-14839 | High | 2022-04-01 | No exploit published | No public exploit | It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using some tool like burp suite etc. |
| CVE-2022-0853 | High | 2022-03-11 | Mitigation candidate | Proof of concept only | A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability. |
| CVE-2021-4104 | High | 2021-12-14 | Protected by Waratek | Exploited | JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions. |
| CVE-2021-44228 | Critical | 2021-12-10 | Protected by Waratek | Exploited | Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects. |
| CVE-2021-3642 | Medium | 2021-08-05 | No exploit published | No public exploit | A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. |
| CVE-2021-20306 | Medium | 2021-06-01 | No exploit published | No public exploit | A flaw was found in the BPMN editor in version jBPM 7.51.0.Final. Any authenticated user from any project can see the name of Ruleflow Groups from other projects, despite the user not having access to those projects. The highest threat from this vulnerability is to confidentiality. |
| CVE-2021-20218 | High | 2021-03-16 | Protected by Waratek | No public exploit | A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after. This flaw allows a malicious pod/container to cause applications using the fabric8 kubernetes-client `copy` command to extract files outside the working path. The highest threat from this vulnerability is to integrity and system availability. This has been fixed in kubernetes-client-4.13.2 kubernetes-client-5.0.2 kubernetes-client-4.11.2 kubernetes-client-4.7.2 |
| CVE-2020-10714 | High | 2020-09-23 | No exploit published | No public exploit | A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. |
| CVE-2020-1748 | High | 2020-09-16 | No exploit published | No public exploit | A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources. |
| CVE-2020-1714 | High | 2020-05-13 | Protected by Waratek | No public exploit | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution. |
| CVE-2019-14886 | Medium | 2020-03-05 | No exploit published | No public exploit | A vulnerability was found in business-central, as shipped in rhdm-7.5.1 and rhpam-7.5.1, where encoded passwords are stored in errai_security_context. The encoding used for storing the passwords is Base64, not an encryption algorithm, and any recovery of these passwords could lead to user passwords being exposed. |
| CVE-2019-14892 | Critical | 2020-03-02 | No exploit published | No public exploit | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code. |