Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 721

Export CSV
CVE-2023-6236

Eap: oidc app attempting to access the second tenant, the user should be prompted to log

A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second tenant, it should prompt the user to log in again since the second tenant is secured with a different OIDC configuration. The underlying issue is in OidcSessionTokenStore when determining if a cached token should be used or not. This logic needs to be updated to take into account the new "provider-url" option in addition to the "realm" option. EAP-7 does not provide the vulnerable provider-url configuration option in its OIDC implementation and is not affected by this flaw.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jbosseapxp
CVE-2024-7341

Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Enterprise Linux and 5 more
CVE-2024-8883

Keycloak: vulnerable redirect uri validation results in open redirec

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

CVSS 3.1 · 6.1 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Jboss Enterprise Application Platform and 7 more
CVE-2024-4629

Keycloak: potential bypass of brute force protection

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Enterprise Linux and 9 more
CVE-2023-2976

Use of temporary directory for file creation in `FileBackedOutputStream` in Guava

Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 to 31.1 on Unix systems and Android Ice Cream Sandwich allows other users and apps on the machine with access to the default Java temporary directory to be able to access the files created by the class. Even though the security vulnerability is fixed in version 32.0.0, we recommend using version 32.0.1 as version 32.0.0 breaks some functionality under Windows.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Guava Amq Broker Amq Streams and 7 more
CVE-2025-5731

Infinispan: credential leakage in infinispan cli

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Data Grid Jboss Data Grid and 3 more
CVE-2024-4068

Memory Exhaustion in braces

The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Jonschlinkert Micromatch Redhat
Products
Braces Braces Acm and 5 more
CVE-2025-23184

Apache CXF: Denial of Service vulnerability with temporary files

A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream instances may not be closed and, if backed by temporary files, may fill up the file system (it applies to servers and clients).

CVSS 3.1 · 5.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Enterprise Application Platform
CVE-2024-10234

Wildfly: wildfly vulnerable to cross-site scripting (xss)

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the server.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Jboss Data Grid and 5 more
CVE-2024-1102

Jberet: jberet-core logging database credentials

A vulnerability was found in jberet-core logging. An exception in 'dbProperties' might display user credentials such as the username and password for the database-connection.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jberet Redhat
Products
Jberet Build Keycloak Jboss Data Grid and 4 more
CVE-2020-11023

Potential XSS vulnerability in jQuery

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS 3.1 · 6.9 Medium EPSS 84.9% KEV · Listed
Vendors
Debian Drupal Fedoraproject and 5 more
Products
Debian Linux Drupal Fedora and 75 more
CVE-2023-3629

Infinispan: non-admins should not be able to get cache config via rest api

A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Data Grid Jboss Data Grid and 1 more
CVE-2023-3628

Infispan: rest bulk ops don't check permissions

A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Infinispan Redhat
Products
Infinispan Data Grid Jboss Data Grid and 1 more
CVE-2023-4061

Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor

A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Wildfly Core
CVE-2022-0866

wildfly: Wildfly management of EJB Session context returns wrong caller principal with Elytron Security enabled

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Openstack Platform Red Hat Single Sign On and 1 more
CVE-2024-27316

Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

CVSS 3.1 · 7.5 High EPSS 88.8% KEV · Not listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Ontap and 4 more
CVE-2017-9798

httpd: Use-after-free by limiting unregistered HTTP method (Optionsbleed)

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret data. This is a use-after-free issue and thus secret data is not always sent, and the specific data depends on many factors including configuration. Exploitation with .htaccess can be blocked with a patch to the ap_limit_section function in server/core.c.

CVSS 3.1 · 7.5 High EPSS 94.7% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Http Server Debian Linux Enterprise Linux and 5 more
CVE-2024-21634

Ion Java StackOverflow vulnerability

Amazon Ion is a Java implementation of the Ion data notation. Prior to version 1.10.5, a potential denial-of-service issue exists in `ion-java` for applications that use `ion-java` to deserialize Ion text encoded data, or deserialize Ion text or binary encoded data into the `IonValue` model and then invoke certain `IonValue` methods on that in-memory representation. An actor could craft Ion data that, when loaded by the affected application and/or processed using the `IonValue` model, results in a `StackOverflowError` originating from the `ion-java` library. The patch is included in `ion-java` 1.10.5. As a workaround, do not load data which originated from an untrusted source or that could have been tampered with.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Amazon Redhat
Products
Ion Jboss Enterprise Application Platform
CVE-2023-44483

Apache Santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to upgrade to version 2.2.6, 2.3.4, or 3.0.3, which fixes this issue.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Apache Redhat
Products
Santuario Xml Security For Java Apache Camel Spring Boot Camel Quarkus and 3 more