Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 30

Export CSV
CVE-2011-5063

tomcat: Multiple weaknesses in HTTP DIGEST authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weaker authentication or authorization requirements, a different vulnerability than CVE-2011-1184.

CVSS 2.0 · 4.3 Medium EPSS 6.5% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Communications Platform and 6 more
CVE-2011-5064

tomcat: Multiple weaknesses in HTTP DIGEST authentication

DigestAuthenticator.java in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 uses Catalina as the hard-coded server secret (aka private key), which makes it easier for remote attackers to bypass cryptographic protection mechanisms by leveraging knowledge of this string, a different vulnerability than CVE-2011-1184.

CVSS 2.0 · 4.3 Medium EPSS 6.3% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Communications Platform and 6 more
CVE-2011-5245

RESTEasy: XML eXternal Entity (XXE) flaw

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.

CVSS 2.0 · 5.0 Medium EPSS 3.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 6 more
CVE-2012-0022

tomcat: large number of parameters DoS

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.

CVSS 2.0 · 5.0 Medium EPSS 10.5% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Communications Platform and 7 more
CVE-2012-0079

OpenSSO: Unspecified vulnerability allows remote attackers to affect integrity via unknown vectors

Unspecified vulnerability in Oracle OpenSSO 7.1 and 8.0 allows remote attackers to affect integrity via unknown vectors related to Administration.

CVSS 2.0 · 4.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Oracle Redhat
Products
Opensso Jboss Soa Platform
CVE-2012-1167

JBoss: authentication bypass when running under JACC with ignoreBaseDecision on JBossWebRealm

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseDecision property is set to true on the JBossWebRealm, does not properly check the permissions created by the WebPermissionMapping class, which allows remote authenticated users to access arbitrary applications.

CVSS 2.0 · 4.6 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Brms Platform Jboss Enterprise Portal Platform and 3 more
CVE-2012-2377

JGroups diagnostics service enabled by default with no authentication when a JGroups channel is started

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows remote attackers in adjacent networks to read diagnostics information via a crafted IP multicast.

CVSS 2.0 · 3.3 Low EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Brms Platform Jboss Enterprise Portal Platform and 3 more
CVE-2020-14340

xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.

CVSS 3.1 · 5.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Communications Cloud Native Core Console Communications Cloud Native Core Network Repository Function Communications Cloud Native Core Policy and 13 more
CVE-2012-5626

JBoss - EJB method invocation ignores roles specified using the @RunAs annotation

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Brms Jboss Enterprise Application Platform Jboss Enterprise Web Server and 3 more