WaratekVRT Sign in

Medium Server-core CVEs

4 CVEs, 2 exploited, 1 protected by Waratek

Reset
More filters (1)
Columns
Product server-core✕
Overview 4 matches · 1 protected · 2 exploited · 0 CISA KEV · 2 public PoC · 0 EPSS ≥ 0.5
4matches 1protected25.0% 2exploited50.0% 0CISA KEV0.0% 2public PoC50.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 1 25.0% Rule in development 0 0.0% Mitigation candidate 1 25.0% No exploit published 2 50.0%
Critical 0 0.0% High 0 0.0% Medium 4 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 1 25.0% partly blocked 0 0.0% not blocked 3 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 2 50.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 50.0%
split by peak 1 / year
No exploit published: 2Mitigation candidate: 1Protected by Waratek: 1 Medium: 4 not blocked: 3blocked by ARMR today: 1 No public exploit: 2Exploited: 2
20181 No exploit published1 Medium1 not blocked1 No public exploit1 20191 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20200 20211 Mitigation candidate1 Medium1 not blocked1 Exploited1 20220 20230 20240 20251 No exploit published1 Medium1 not blocked1 No public exploit1
20182019202020212022202320242025
4 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-3986 Medium 2025-04-27 No exploit published No public exploit A vulnerability was found in Apereo CAS 5.2.6. It has been declared as problematic. This vulnerability affects unknown code of the file cas-5.2.6\core\cas-server-core-configuration-metadata-repository\src\main\java\org\apereo\cas\metadata\rest\CasConfigurationMetadataServerController.java. The manipulation of the argument Name leads to inefficient regular expression complexity. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2021-42567 Medium 2021-12-07 Mitigation candidate Exploited Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.
CVE-2019-17554 Medium 2019-12-04 Protected by Waratek Exploited The XML content type entity deserializer in Apache Olingo versions 4.0.0 to 4.6.0 is not configured to deny the resolution of external entities. Request with content type "application/xml", which trigger the deserialization of entities, can be used to trigger XXE attacks.
CVE-2017-2638 Medium 2018-07-16 No exploit published No public exploit It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.