Overview 9 matches · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
9matches
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
0public PoC0.0%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
9
100.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
9
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
9
100.0%
split by
peak 3 / year
20181
No exploit published1
Medium1
not blocked1
No public exploit1
20190
20202
No exploit published2
Critical1
Medium1
not blocked2
No public exploit2
20210
20220
20233
No exploit published3
High1
Medium2
not blocked3
No public exploit3
20240
20253
No exploit published3
Medium3
not blocked3
No public exploit3
20182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-5731 | Medium | 2025-06-26 | No exploit published | No public exploit | A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found. |
| CVE-2024-6875 | Medium | 2025-03-28 | No exploit published | No public exploit | A vulnerability was found in the Infinispan component in Red Hat Data Grid. The REST compare API may have a buffer leak and an out of memory error can occur when sending continual requests with large POST data to the REST API. |
| CVE-2025-0736 | Medium | 2025-01-28 | No exploit published | No public exploit | A flaw was found in Infinispan, when using JGroups with JDBC_PING. This issue occurs when an application inadvertently exposes sensitive information, such as configuration details or credentials, through logging mechanisms. This exposure can lead to unauthorized access and exploitation by malicious actors. |
| CVE-2023-5384 | High | 2023-12-18 | No exploit published | No public exploit | A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration. |
| CVE-2023-3629 | Medium | 2023-12-18 | No exploit published | No public exploit | A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions. |
| CVE-2023-3628 | Medium | 2023-12-18 | No exploit published | No public exploit | A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions. |
| CVE-2020-25711 | Medium | 2020-12-03 | No exploit published | No public exploit | A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role. |
| CVE-2019-10158 | Critical | 2020-01-02 | No exploit published | No public exploit | A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Session integration can result in incorrect session handling. |
| CVE-2017-2638 | Medium | 2018-07-16 | No exploit published | No public exploit | It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name. |