Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 654

Export CSV
CVE-2014-0005

PicketBox/JBossSX: Unauthorized access to and modification of application server configuration and state by application

PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever configuration and state by deploying a crafted application.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 3 more
CVE-2014-0003

Camel: remote code execution via XSL

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

CVSS 2.0 · 7.5 High EPSS 7.5% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Fuse Esb Enterprise Fuse Management Console and 7 more
CVE-2014-0002

Camel: XML eXternal Entity (XXE) flaw in XSLT component

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 7.5 High EPSS 27.4% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Fuse Esb Enterprise Fuse Management Console and 6 more
CVE-2013-7398

async-http-client: missing hostname verification for SSL certificates

main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of X.509 certificates, which allows man-in-the-middle attackers to spoof HTTPS servers via an arbitrary valid certificate.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Async-http-client Project Redhat
Products
Async-http-client Jboss Bpms Jboss Brms and 2 more
CVE-2013-7397

async-http-client: SSL/TLS certificate verification is disabled under certain conditions

Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set, which allows man-in-the-middle attackers to spoof HTTPS servers by presenting an arbitrary certificate during use of a typical AHC configuration, as demonstrated by a configuration that does not send client certificates.

CVSS 2.0 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Async-http-client Project Redhat
Products
Async-http-client Jboss Bpms Jboss Brms and 2 more
CVE-2013-6469

RTgov: Remote Java Code Execution in MVEL

JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to execute arbitrary Java code via an MVFLEX Expression Language (MVEL) expression. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Fuse Service Works Jboss Overlord Run Time Governance
CVE-2013-5855

JSF: XSS due to insufficient escaping of user-supplied content in outputText tags and EL expressions

Oracle Mojarra 2.2.x before 2.2.6 and 2.1.x before 2.1.28 does not perform appropriate encoding when a (1) <h:outputText> tag or (2) EL expression is used after a scriptor style block, which allows remote attackers to conduct cross-site scripting (XSS) attacks via application-specific vectors.

CVSS 2.0 · 4.3 Medium EPSS 4.7% KEV · Not listed
Vendors
Oracle Redhat
Products
Mojarra Jboss Bpms Jboss Brms and 5 more
CVE-2022-36437

hazelcast: Hazelcast connection caching

The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity of another already authenticated connection. The affected Hazelcast versions are through 4.0.6, 4.1.9, 4.2.5, 5.0.3, and 5.1.2. The affected Hazelcast Jet versions are through 4.5.3.

CVSS 3.1 · 9.1 Critical EPSS 1.1% KEV · Not listed
Vendors
Hazelcast Redhat
Products
Hazelcast Hazelcast-jet Jboss Fuse
CVE-2012-5575

apache-cxf: XML encryption backwards compatibility attacks

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

CVSS 2.0 · 6.4 Medium EPSS 6.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Application Platform and 5 more
CVE-2012-5783

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 3.0 · 3.7 Low EPSS 9.3% KEV · Not listed
Vendors
Apache Canonical Redhat
Products
Httpclient Ubuntu Linux Enterprise Linux and 9 more
CVE-2013-0269

rubygem-json: Denial of Service and SQL Injection

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

CVSS 2.0 · 7.5 High EPSS 13.9% KEV · Not listed
Vendors
Redhat Rhel Sam Rubygems
Products
Fuse Esb Enterprise Jboss Enterprise Soa Platform Jboss Fuse and 3 more
CVE-2013-1768

openjpa: Remote arbitrary code execution by creating a serialized object and leveraging improperly secured server programs

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

CVSS 2.0 · 7.5 High EPSS 9.5% KEV · Not listed
Vendors
Apache Redhat
Products
Openjpa Fuse Esb Enterprise Fuse Management Console and 2 more
CVE-2013-2035

HawtJNI: predictable temporary file name leading to local arbitrary code execution

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Fuse Mq Enterprise Hawtjni Jboss Amq and 9 more
CVE-2013-2160

apache-cxf: Multiple denial of service flaws in the StAX parser

The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.

CVSS 2.0 · 5.0 Medium EPSS 32.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Portal Platform and 1 more
CVE-2013-2172

Java: XML signature spoofing

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

CVSS 2.0 · 4.3 Medium EPSS 5.9% KEV · Not listed
Vendors
Apache Redhat
Products
Santuario Xml Security For Java Fuse Esb Enterprise Fuse Management Console and 8 more
CVE-2013-2192

hadoop: man-in-the-middle vulnerability

The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.

CVSS 2.0 · 3.2 Low EPSS 1.1% KEV · Not listed
Vendors
Apache Redhat
Products
Hadoop Jboss Amq Jboss Fuse and 1 more
CVE-2013-4002

OpenJDK: XML parsing Denial of Service (JAXP, 8017298)

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

CVSS 2.0 · 7.1 High EPSS 24.7% KEV · Not listed
Vendors
Apache Canonical Hp and 7 more
Products
Xerces2 Java Ubuntu Linux Hp-ux and 28 more
CVE-2013-4152

Framework: XML External Entity (XXE) injection flaw

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via an XML external entity declaration in conjunction with an entity reference in a (1) DOMSource, (2) StAXSource, (3) SAXSource, or (4) StreamSource, aka an XML External Entity (XXE) issue.

CVSS 2.0 · 6.8 Medium EPSS 25.6% KEV · Not listed
Vendors
Redhat Springsource Vmware
Products
Jboss Amq Jboss Enterprise Soa Platform Jboss Fuse and 3 more
CVE-2013-4221

Restlet: remote code execution due to insecure XML deserialization

The default configuration of the ObjectRepresentation class in Restlet before 2.1.4 deserializes objects from untrusted sources using the Java XMLDecoder, which allows remote attackers to execute arbitrary Java code via crafted XML.

CVSS 2.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Redhat Restlet
Products
Fuse Esb Enterprise Fuse Management Console Fuse Mq Enterprise and 3 more