Overview 7 matches · 1 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
Protected by Waratek
1
14.3%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
6
85.7%
Outside Waratek scope
0
0.0%
Not applicable
0
0.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
1
14.3%
partly blocked
0
0.0%
not blocked
6
85.7%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
0
0.0%
No public exploit
7
100.0%
split by
peak 2 / year
20181
Protected by Waratek1
Medium1
blocked by ARMR today1
No public exploit1
20191
No exploit published1
Medium1
not blocked1
No public exploit1
20200
20210
20222
No exploit published2
High1
Low1
not blocked2
No public exploit2
20231
No exploit published1
Medium1
not blocked1
No public exploit1
20240
20252
No exploit published2
High1
Medium1
not blocked2
No public exploit2
20182019202020212022202320242025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-23368 | High | 2025-03-04 | No exploit published | No public exploit | A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI. |
| CVE-2025-23367 | Medium | 2025-01-30 | No exploit published | No public exploit | A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. When authorization to control management operations is secured using the Role Based Access Control provider, a user without the required privileges can suspend or resume the server. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action. |
| CVE-2023-4061 | Medium | 2023-11-08 | No exploit published | No public exploit | A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system. |
| CVE-2021-3644 | Low | 2022-08-26 | No exploit published | No public exploit | A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access and possibly retrieve the item which was stored in the vault. The highest threat from this vulnerability is data confidentiality and integrity. |
| CVE-2021-3717 | High | 2022-05-24 | No exploit published | No public exploit | A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0. |
| CVE-2019-14838 | Medium | 2019-10-14 | No exploit published | No public exploit | A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server |
| CVE-2018-10862 | Medium | 2018-07-27 | Protected by Waratek | No public exploit | WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability. |