Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 105

Export CSV
CVE-2014-3600

ActiveMQ: XXE via XPath expression evaluation

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

CVSS 3.0 · 9.8 Critical EPSS 8.2% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Esb Enterprise Fuse Management Console and 3 more
CVE-2017-8028

spring-ldap: Authentication with userSearch and STARTTLS allows authentication with arbitrary password

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

CVSS 3.0 · 8.1 High EPSS 2.6% KEV · Not listed
Vendors
Debian Pivotal Software Redhat
Products
Debian Linux Spring-ldap Jboss Amq and 1 more
CVE-2014-0225

Framework: Information disclosure via SSRF

When processing user provided XML documents, the Spring Framework 4.0.0 to 4.0.4, 3.0.0 to 3.2.8, and possibly earlier unsupported versions did not disable by default the resolution of URI references in a DTD declaration. This enabled an XXE attack.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed
Vendors
Pivotal Software Redhat Vmware
Products
Spring Framework Jboss Amq Jboss Fuse and 1 more
CVE-2017-5929

logback: Serialization vulnerability in SocketServer and ServerSocketReceiver

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

CVSS 3.1 · 9.8 Critical EPSS 7.5% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Jboss Amq Jboss Bpms and 4 more
CVE-2017-5662

batik: XML external entity processing vulnerability

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.

CVSS 3.0 · 7.3 High EPSS 4.1% KEV · Not listed
Vendors
Apache Redhat
Products
Batik Jboss Amq Jboss Bpms and 2 more
CVE-2017-5656

cxf: CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

CVSS 3.0 · 7.5 High EPSS 6.8% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Fuse and 1 more
CVE-2017-3156

cxf: CXF OAuth2 Hawk and JOSE MAC Validation code are vulnerable to timing attacks

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

CVSS 3.0 · 7.5 High EPSS 6.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Fuse
CVE-2015-3254

thrift: Infinite recursion via vectors involving the skip function

The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.

CVSS 3.0 · 6.5 Medium EPSS 5.3% KEV · Not listed
Vendors
Apache Redhat
Products
Thrift Jboss Amq Jboss Data Virtualization and 1 more
CVE-2017-3159

camel-snakeyaml: Unmarshalling operation is vulnerable to RCE

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

CVSS 3.0 · 9.8 Critical EPSS 6.3% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Jboss Amq Jboss Fuse
CVE-2017-12634

camel-castor: Apache Camel's Castor unmarshalling operation is vulnerable to Remote Code Execution attacks

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data can lead to security flaws.

CVSS 3.0 · 9.8 Critical EPSS 7.2% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Jboss Amq Jboss Fuse
CVE-2017-5643

camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE

Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.

CVSS 3.0 · 7.4 High EPSS 5.9% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Jboss Amq Jboss Fuse
CVE-2016-8739

apache-cxf: Atom entity provider of Apache CXF JAX-RS is vulnerable to XXE

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides a number of Atom JAX-RS MessageBodyReaders. These readers use Apache Abdera Parser which expands XML entities by default which represents a major XXE risk.

CVSS 3.0 · 7.5 High EPSS 7.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Fuse
CVE-2016-9879

Security: Improper handling of path parameters allows bypassing the security constraint

An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parameters when processing security constraints. By adding a URL path parameter with an encoded "/" to a request, an attacker may be able to bypass a security constraint. The root cause of this issue is a lack of clarity regarding the handling of path parameters in the Servlet Specification. Some Servlet containers include path parameters in the value returned for getPathInfo() and some do not. Spring Security uses the value returned by getPathInfo() as part of the process of mapping requests to security constraints. The unexpected presence of path parameters can cause a constraint to be bypassed. Users of Apache Tomcat (all current versions) are not affected by this vulnerability since Tomcat follows the guidance previously provided by the Servlet Expert group and strips path parameters from the value returned by getContextPath(), getServletPath(), and getPathInfo(). Users of other Servlet containers based on Apache Tomcat may or may not be affected depending on whether or not the handling of path parameters has been modified. Users of IBM WebSphere Application Server 8.5.x are known to be affected. Users of other containers that implement the Servlet specification may be affected.

CVSS 3.0 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Ibm Redhat Vmware
Products
Websphere Application Server Jboss Amq Jboss Fuse and 1 more
CVE-2016-5725

jsch: ChannelSftp path traversal vulnerability

Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP servers to write to arbitrary files via a ..\ (dot dot backslash) in a response to a recursive GET command.

CVSS 3.0 · 5.9 Medium EPSS 24.1% KEV · Not listed
Vendors
Jcraft Microsoft Redhat
Products
Jsch Windows Jboss Amq and 1 more
CVE-2015-0226

wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487)

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

CVSS 3.0 · 7.5 High EPSS 5.5% KEV · Not listed
Vendors
Apache Redhat
Products
Wss4j Jboss Amq Jboss Data Grid and 4 more
CVE-2016-8749

camel-jacksonxml: Unmarshalling operation are vulnerable to RCE

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Jboss Amq Jboss Fuse
CVE-2016-6812

apache-cxf: XSS in Apache CXF FormattedServiceListWriter

The HTTP transport module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 uses FormattedServiceListWriter to provide an HTML page which lists the names and absolute URL addresses of the available service endpoints. The module calculates the base URL using the current HttpServletRequest. The calculated base URL is used by FormattedServiceListWriter to build the service endpoint absolute URLs. If the unexpected matrix parameters have been injected into the request URL then these matrix parameters will find their way back to the client in the services list page which represents an XSS risk to the client.

CVSS 3.0 · 6.1 Medium EPSS 7.5% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Fuse
CVE-2015-5183

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Redhat
Products
Amq Amq Broker Jboss A-mq and 3 more