Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 62

Export CSV
CVE-2014-3481

JAX-RS: Information disclosure via XML eXternal Entity (XXE)

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 5.0 Medium EPSS 3.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Data Grid Jboss Data Virtualization Jboss Enterprise Application Platform and 3 more
CVE-2014-3530

PicketLink: XXE via insecure DocumentBuilderFactory usage

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 7 more
CVE-2014-3577

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

CVSS 3.0 · 4.8 Medium EPSS 9.2% KEV · Not listed
Vendors
Apache Redhat
Products
Httpasyncclient Httpclient Enterprise Linux and 15 more
CVE-2014-7849

Management: Limited RBAC authorization bypass

The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which allows remote authenticated users to add, modify, and undefine otherwise restricted attributes by leveraging the Maintainer role.

CVSS 2.0 · 4.0 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Operations Network
CVE-2014-7853

Subsystem: Information disclosure via incorrect sensitivity classification of attribute

The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properly assign socket-binding-ref sensitivity classification to the security-domain attribute, which allows remote authenticated users to obtain sensitive information by leveraging access to the security-domain attribute.

CVSS 2.0 · 4.0 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Operations Network
CVE-2014-8122

Weld: Limited information disclosure via stale thread state

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.

CVSS 2.0 · 4.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 4 more
CVE-2015-0225

Cassandra: remote code execution via unauthenticated JMX/RMI interface

The default configuration in Apache Cassandra 1.2.0 through 1.2.19, 2.0.0 through 2.0.13, and 2.1.0 through 2.1.3 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request.

CVSS 2.0 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Apache Redhat
Products
Cassandra Jboss Operations Network
CVE-2015-0297

RHQ: ServerInvokerServlet remote code exec

Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

CVSS 2.0 · 9.0 Critical EPSS 2.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2015-3253

groovy: remote execution of untrusted code in class MethodClosure

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

CVSS 3.0 · 9.8 Critical EPSS 41.0% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Groovy Health Sciences Clinical Development Center Retail Order Broker Cloud Service and 11 more
CVE-2015-3267

JON: Cross Site scripting possible on the JBoss ON 404 error page

Cross-site scripting (XSS) vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVSS 2.0 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2016-0800

SSL/TLS: Cross-protocol attack on TLS using SSLv2 (DROWN)

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

CVSS 3.0 · 5.9 Medium EPSS 82.1% KEV · Not listed
Vendors
Openssl Pulsesecure Redhat
Products
Openssl Client Steel Belted Radius and 8 more
CVE-2016-3737

JON: The agent/server communication deserializes data, and does not require authentication

The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.

CVSS 3.0 · 9.8 Critical EPSS 6.8% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2016-5422

JON3: privilege escalation via improper authorization

The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request.

CVSS 3.0 · 8.8 High EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2016-6330

JON: incomplete fix for CVE-2016-3737

The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2012-0062

JON: Unapproved agents can hijack an approved agent's endpoint by using a null security token

Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 allows remote attackers to hijack agent sessions via an agent registration request without a security token.

CVSS 2.0 · 5.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2012-0052

JON: Unapproved agents can connect using the name of an existing approved agent

Red Hat JBoss Operations Network (JON) before 2.4.2 and 3.0.x before 3.0.1 does not check the JON agent key, which allows remote attackers to spoof the identity of arbitrary agents via the registered agent name.

CVSS 2.0 · 5.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2012-5920

GWT: unknown XSS flaw

Cross-site scripting (XSS) vulnerability in Google Web Toolkit (GWT) 2.4 through 2.5 Final, as used in JBoss Operations Network (ON) 3.1.1 and possibly other products, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2012-4563.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google Redhat
Products
Web Toolkit Jboss Operations Network
CVE-2013-4293

Server: Plaintext passwords in server logs

The server in Red Hat JBoss Operations Network (JON) 3.1.2 logs passwords in plaintext, which allows local users to obtain sensitive information by reading the log files.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2013-4373

Drift: Malicious drift file import due to insecure temporary file usage

The storeFiles method in JPADriftServerBean in Red Hat JBoss Operations Network (JON) 3.1.2 allows local users to load arbitrary drift files into a server by writing the files to the temporary directory that is used to unpack zip files.

CVSS 2.0 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network