Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 69

Export CSV
CVE-2013-6468

Drools: Remote Java Code Execution in MVEL

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expression.

CVSS 2.0 · 6.5 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpm Suite Jboss Bpms Jboss Brms and 2 more
CVE-2013-7397

async-http-client: SSL/TLS certificate verification is disabled under certain conditions

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Async-http-client Project Redhat
Products
Async-http-client Jboss Bpms Jboss Brms and 2 more
CVE-2013-7398

async-http-client: missing hostname verification for SSL certificates

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Async-http-client Project Redhat
Products
Async-http-client Jboss Bpms Jboss Brms and 2 more
CVE-2014-0002

Camel: XML eXternal Entity (XXE) flaw in XSLT component

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 7.5 High EPSS 27.4% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Fuse Esb Enterprise Fuse Management Console and 6 more
CVE-2014-0003

Camel: remote code execution via XSL

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

CVSS 2.0 · 7.5 High EPSS 7.5% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Fuse Esb Enterprise Fuse Management Console and 7 more
CVE-2014-0005

PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application

PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 3 more
CVE-2014-0034

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

CVSS 2.0 · 4.3 Medium EPSS 7.4% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0035

CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS 2.0 · 4.3 Medium EPSS 7.1% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0058

EAP6: Plain text password logging during security audit

The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to obtain passwords by reading the log files.

CVSS 2.0 · 1.9 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 5 more
CVE-2014-0059

JBossSX/PicketBox: World readable audit.log file

JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 4 more
CVE-2014-0093

6: JSM policy not respected by deployed applications

Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.

CVSS 2.0 · 5.8 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 2 more
CVE-2014-0107

Xalan-Java: insufficient constraints in secure processing feature

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

CVSS 2.0 · 7.5 High EPSS 14.1% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Xalan-java Webcenter Sites Enterprise Linux and 12 more
CVE-2014-0109

CXF: HTML content posted to SOAP endpoint could cause OOM errors

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-3625

Framework: directory traversal flaw

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CVSS 2.0 · 5.0 Medium EPSS 9.9% KEV · Not listed
Vendors
Pivotal Software Redhat Vmware
Products
Spring Framework Jboss Amq Jboss Bpms and 4 more
CVE-2014-3682

jbpm-designer: XXE in BPMN2 import

XML external entity (XXE) vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file.

CVSS 2.0 · 7.5 High EPSS 2.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jbpm-designer
CVE-2014-7827

Security: Wrong security context loaded when using SAML2 STS Login Module

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.

CVSS 2.0 · 3.5 Low EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform
CVE-2014-7839

RESTeasy: External entities expanded by DocumentProvider

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVSS 2.0 · 6.4 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 4 more
CVE-2014-8114

UberFire: Information disclosure and RCE via insecure file upload/download servlets

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.

CVSS 2.0 · 6.8 Medium EPSS 3.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Uberfire
CVE-2014-8122

Weld: Limited information disclosure via stale thread state

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.

CVSS 2.0 · 4.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 4 more
CVE-2014-8125

jBPM: BPMN2 file processing XXE in Process Execution

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

CVSS 2.0 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Redhat
Products
Drools Jboss Bpms Jboss Brms and 1 more