Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 721

Export CSV
CVE-2016-5406

EAP7 Privilege escalation when managing domain including earlier version slaves

The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain privileges by leveraging failure to propagate administrative RBAC configuration to all slaves.

CVSS 3.0 · 8.8 High EPSS 2.9% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform
CVE-2014-0093

6: JSM policy not respected by deployed applications

Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access restrictions.

CVSS 2.0 · 5.8 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 2 more
CVE-2016-4993

eap: HTTP header injection / response splitting

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

CVSS 3.0 · 6.1 Medium EPSS 2.5% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Wildfly Application Server
CVE-2014-0098

httpd: mod_log_config does not properly handle logging certain cookies resulting in DoS

The log_cookie function in mod_log_config.c in the mod_log_config module in the Apache HTTP Server before 2.4.8 allows remote attackers to cause a denial of service (segmentation fault and daemon crash) via a crafted cookie that is not properly handled during truncation.

CVSS 2.0 · 5.0 Medium EPSS 26.7% KEV · Not listed
Vendors
Apache Canonical Oracle and 1 more
Products
Http Server Ubuntu Linux Http Server and 4 more
CVE-2014-0107

Xalan-Java: insufficient constraints in secure processing feature

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

CVSS 2.0 · 7.5 High EPSS 14.1% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Xalan-java Webcenter Sites Enterprise Linux and 12 more
CVE-2014-0109

CXF: HTML content posted to SOAP endpoint could cause OOM errors

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2016-2178

openssl: Non-constant time codepath followed for certain operations in DSA implementation

The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it easier for local users to discover a DSA private key via a timing side-channel attack.

CVSS 3.1 · 5.5 Medium EPSS 1.2% KEV · Not listed
Vendors
Canonical Debian Nodejs and 4 more
Products
Ubuntu Linux Debian Linux Node.js and 7 more
CVE-2014-0110

CXF: Large invalid content could cause temporary space to fill

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0118

httpd: mod_deflate denial of service

The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote attackers to cause a denial of service (resource consumption) via crafted request data that decompresses to a much larger size.

CVSS 2.0 · 4.3 Medium EPSS 37.3% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Http Server Debian Linux Enterprise Linux and 3 more
CVE-2016-2177

openssl: Possible integer overflow vulnerabilities in codebase

OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service (integer overflow and application crash) or possibly have unspecified other impact by leveraging unexpected malloc behavior, related to s3_srvr.c, ssl_sess.c, and t1_lib.c.

CVSS 3.0 · 9.8 Critical EPSS 44.5% KEV · Not listed
Vendors
Hp Openssl Oracle and 1 more
Products
Icewall Mcrp Icewall Sso Icewall Sso Agent Option and 6 more
CVE-2016-2141

JGroups: Authorization bypass

It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Data Grid Jboss Data Virtualization and 8 more
CVE-2014-0193

netty: DoS via memory exhaustion during data aggregation

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Netty Redhat
Products
Netty Jboss Amq Jboss Bpms and 7 more
CVE-2016-2109

openssl: ASN.1 BIO handling of large amounts of data

The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory consumption) via a short invalid encoding.

CVSS 3.0 · 7.5 High EPSS 29.2% KEV · Not listed
Vendors
Openssl Redhat
Products
Openssl Enterprise Linux Enterprise Linux Desktop and 9 more
CVE-2014-0221

openssl: DoS when sending invalid DTLS handshake

The dtls1_get_message_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h allows remote attackers to cause a denial of service (recursion and client crash) via a DTLS hello message in an invalid DTLS handshake.

CVSS 2.0 · 4.3 Medium EPSS 87.9% KEV · Not listed
Vendors
Fedoraproject Mariadb Openssl and 3 more
Products
Fedora Mariadb Openssl and 10 more
CVE-2014-0224

openssl: SSL/TLS MITM vulnerability

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the "CCS Injection" vulnerability.

CVSS 3.1 · 7.4 High EPSS 95.3% KEV · Not listed
Vendors
Fedoraproject Filezilla-project Mariadb and 6 more
Products
Fedora Filezilla Server Mariadb and 20 more
CVE-2014-0226

httpd: mod_status heap-based buffer overflow

Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly obtain sensitive credential information or execute arbitrary code, via a crafted request that triggers improper scoreboard handling within the status_handler function in modules/generators/mod_status.c and the lua_ap_scoreboard_worker function in modules/lua/lua_request.c.

CVSS 2.0 · 6.8 Medium EPSS 85.8% KEV · Not listed
Vendors
Apache Debian Oracle and 1 more
Products
Http Server Debian Linux Enterprise Manager Ops Center and 6 more
CVE-2016-2108

openssl: Memory corruption in the ASN.1 encoder

The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue.

CVSS 3.0 · 9.8 Critical EPSS 77.9% KEV · Not listed
Vendors
Google Openssl Redhat
Products
Android Openssl Enterprise Linux and 10 more
CVE-2014-0248

Seam: RCE via unsafe logging in AuthenticationFilter

org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.

CVSS 2.0 · 6.8 Medium EPSS 3.5% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Soa Platform Jboss Enterprise Web Framework and 2 more