Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 305

Export CSV
CVE-2017-2670

undertow: IO thread DoS via unclean Websocket closing

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

CVSS 3.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Enterprise Linux Jboss Data Grid and 3 more
CVE-2017-2638

infinispan: auth bypass in REST api

It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints. An attacker could use this vulnerability to read or modify data in the default cache or a known cache name.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Jboss Data Grid
CVE-2017-15089

infinispan: Unsafe deserialization of malicious object injected into data cache

It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and possibly conduct further attacks.

CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Jboss Data Grid Jboss Enterprise Application Platform and 3 more
CVE-2016-0750

client: unchecked deserialization in marshaller util

The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.

CVSS 3.0 · 4.2 Medium EPSS 2.4% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Jboss Data Grid Jboss Single Sign On