Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 305

Export CSV
CVE-2022-0084

xnio: org.xnio.StreamConnection.notifyReadClosed log to debug instead of stderr

A flaw was found in XNIO, specifically in the notifyReadClosed method. The issue revealed this method was logging a message to another expected end. This flaw allows an attacker to send flawed requests to a server, possibly causing log contention-related performance concerns or an unwanted disk fill-up.

CVSS 3.1 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Integration Camel K Integration Camel Quarkus Jboss Data Grid and 6 more
CVE-2021-3642

wildfly-elytron: possible timing attack in ScramServer

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Build Of Quarkus Camel Quarkus and 15 more
CVE-2021-38153

Timing Attack Vulnerability for Apache Kafka Connect and Clients

Some components in Apache Kafka use `Arrays.equals` to validate a password or key, which is vulnerable to timing attacks that make brute force attacks for such credentials more likely to be successful. Users should upgrade to 2.8.1 or higher, or 3.0.0 or higher where this vulnerability has been fixed. The affected versions include Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.6.0, 2.6.1, 2.6.2, 2.7.0, 2.7.1, and 2.8.0.

CVSS 3.1 · 5.9 Medium EPSS 6.2% KEV · Not listed
Vendors
Apache Oracle Quarkus and 1 more
Products
Kafka Communications Brm - Elastic Charging Engine Communications Cloud Native Core Policy and 12 more
CVE-2021-31917

Infinispan: Authentication bypass on REST endpoints when using DIGEST authentication mechanism

A flaw was found in Red Hat DataGrid 8.x (8.0.0, 8.0.1, 8.1.0 and 8.1.1) and Infinispan (10.0.0 through 12.0.0). An attacker could bypass authentication on all REST endpoints when DIGEST is used as the authentication method. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan-server-rest Data Grid Jboss Data Grid
CVE-2021-0341

okhttp: information disclosure via improperly used cryptographic function

In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-171980069

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Android Amq Streams Jboss Data Grid and 4 more
CVE-2020-7238

netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

CVSS 3.1 · 7.5 High EPSS 3.5% KEV · Not listed
Vendors
Debian Fedoraproject Netty and 1 more
Products
Debian Linux Fedora Netty and 17 more
CVE-2020-25711

infinispan: authorization check missing for server management operations

A flaw was found in infinispan 10 REST API, where authorization permissions are not checked while performing some server management operations. When authz is enabled, any user with authentication can perform operations like shutting down the server without the ADMIN role.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed
Vendors
Infinispan Netapp Redhat
Products
Infinispan Active Iq Unified Manager Data Grid and 1 more
CVE-2020-25689

wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller

A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain-controller. This flaw allows an attacker to cause an Out of memory (OOM) issue, leading to a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Oncommand Insight Service Level Manager and 8 more
CVE-2020-25644

wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Netapp Redhat
Products
Oncommand Insight Oncommand Workflow Automation Service Level Manager and 9 more
CVE-2020-1757

undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus and 5 more
CVE-2020-1748

Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Decision Manager Jboss Data Grid Jboss Enterprise Application Platform and 6 more
CVE-2020-1745

undertow: AJP File Read/Inclusion Vulnerability

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.

CVSS 3.1 · 8.6 High EPSS 5.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 5 more
CVE-2020-1719

Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 4 more
CVE-2020-1695

resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed.

CVSS 3.1 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Fedoraproject Redhat
Products
Fedora Enterprise Linux Jboss Data Grid and 6 more
CVE-2020-14340

xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.

CVSS 3.1 · 5.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Communications Cloud Native Core Console Communications Cloud Native Core Network Repository Function Communications Cloud Native Core Policy and 13 more
CVE-2020-11612

netty: compression/decompression codecs don't enforce limits on buffer allocation sizes

The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.

CVSS 3.1 · 7.5 High EPSS 9.2% KEV · Not listed
Vendors
Debian Fedoraproject Netapp and 3 more
Products
Debian Linux Fedora Oncommand Api Services and 23 more
CVE-2020-10771

infinispan-server-rest: Actions with effects should not be permitted via GET requests using REST API

A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery (CSRF) attack.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Infinispan Netapp Redhat
Products
Infinispan-server-rest Oncommand Insight Data Grid and 1 more
CVE-2020-10746

Infinispan: REST and HotRod APIs unsecured locally by default

A flaw was found in Infinispan (org.infinispan:infinispan-server-runtime) version 10, where it permits local access to controls via both REST and HotRod APIs. This flaw allows a user authenticated to the local machine to perform all operations on the caches, including the creation, update, deletion, and shutdown of the entire server.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan-server-runtime Jboss Data Grid
CVE-2020-10714

wildfly-elytron: session fixation when using FORM authentication

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Netapp Redhat
Products
Oncommand Insight Codeready Studio Descision Manager and 10 more