Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 86

Export CSV
CVE-2015-1427

elasticsearch: remote code execution via Groovy sandbox bypass

The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.

CVSS 3.1 · 9.8 Critical EPSS 99.9% KEV · Listed
Vendors
Elastic Redhat
Products
Elasticsearch Fuse Jboss Amq and 1 more
CVE-2014-3600

ActiveMQ: XXE via XPath expression evaluation

XML external entity (XXE) vulnerability in Apache ActiveMQ 5.x before 5.10.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

CVSS 3.0 · 9.8 Critical EPSS 8.2% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Esb Enterprise Fuse Management Console and 3 more
CVE-2014-3612

JAAS: LDAPLoginModule allows empty password authentication

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.

CVSS 2.0 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Esb Enterprise Fuse Management Console and 3 more
CVE-2014-0002

Camel: XML eXternal Entity (XXE) flaw in XSLT component

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 7.5 High EPSS 27.4% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Fuse Esb Enterprise Fuse Management Console and 6 more
CVE-2014-0003

Camel: remote code execution via XSL

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

CVSS 2.0 · 7.5 High EPSS 7.5% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Fuse Esb Enterprise Fuse Management Console and 7 more
CVE-2014-0074

Shiro: successful authentication without specifying user name or password

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

CVSS 2.0 · 7.5 High EPSS 5.5% KEV · Not listed
Vendors
Apache Redhat
Products
Shiro Fuse Esb Enterprise Fuse Management Console and 3 more
CVE-2014-0107

Xalan-Java: insufficient constraints in secure processing feature

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

CVSS 2.0 · 7.5 High EPSS 14.1% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Xalan-java Webcenter Sites Enterprise Linux and 12 more
CVE-2011-0541

fuse: unprivileged user can unmount arbitrary locations via symlink attack

fuse 2.8.5 and earlier does not properly handle when /etc/mtab cannot be updated, which allows local users to unmount arbitrary directories via a symlink attack.

CVSS 2.0 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fuse Redhat
Products
Fuse Enterprise Linux
CVE-2013-1880

ActiveMQ: XSS vulnerability in portfolioPublish demo application

Cross-site scripting (XSS) vulnerability in the Portfolio publisher servlet in the demo web application in Apache ActiveMQ before 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the refresh parameter to demo/portfolioPublish, a different vulnerability than CVE-2012-6092.

CVSS 2.0 · 4.3 Medium EPSS 6.8% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Mq Enterprise
CVE-2013-1879

ActiveMQ: XSS vulnerability in scheduled.jsp

Cross-site scripting (XSS) vulnerability in scheduled.jsp in Apache ActiveMQ 5.8.0 and earlier allows remote attackers to inject arbitrary web script or HTML via vectors involving the "cron of a message."

CVSS 2.0 · 4.3 Medium EPSS 6.4% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Mq Enterprise
CVE-2013-1768

openjpa: Remote arbitrary code execution by creating a serialized object and leveraging improperly secured server programs

The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.

CVSS 2.0 · 7.5 High EPSS 9.5% KEV · Not listed
Vendors
Apache Redhat
Products
Openjpa Fuse Esb Enterprise Fuse Management Console and 2 more
CVE-2013-0269

rubygem-json: Denial of Service and SQL Injection

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

CVSS 2.0 · 7.5 High EPSS 13.9% KEV · Not listed
Vendors
Redhat Rhel Sam Rubygems
Products
Fuse Esb Enterprise Jboss Enterprise Soa Platform Jboss Fuse and 3 more
CVE-2013-0239

apache-cxf: UsernameTokenPolicyValidator and UsernameTokenInterceptor allow empty passwords to authenticate

Apache CXF before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3, when the plaintext UsernameToken WS-SecurityPolicy is enabled, allows remote attackers to bypass authentication via a security header of a SOAP request containing a UsernameToken element that lacks a password child element.

CVSS 2.0 · 5.0 Medium EPSS 4.7% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Application Platform and 1 more
CVE-2012-6551

activemq: DoS by resource consumption via HTTP requests to sample webapp

The default configuration of Apache ActiveMQ before 5.8.0 enables a sample web application, which allows remote attackers to cause a denial of service (broker resource consumption) via HTTP requests.

CVSS 2.0 · 5.0 Medium EPSS 7.8% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Mq Enterprise
CVE-2012-6092

activemq: Multiple XSS flaws in web demos

Multiple cross-site scripting (XSS) vulnerabilities in the web demos in Apache ActiveMQ before 5.8.0 allow remote attackers to inject arbitrary web script or HTML via (1) the refresh parameter to PortfolioPublishServlet.java (aka demo/portfolioPublish or Market Data Publisher), or vectors involving (2) debug logs or (3) subscribe messages in webapp/websocket/chat.js. NOTE: AMQ-4124 is covered by CVE-2012-6551.

CVSS 2.0 · 4.3 Medium EPSS 6.9% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Mq Enterprise
CVE-2012-5633

apache-cxf: Bypass of security constraints on WS endpoints when using WSS4JInInterceptor

The URIMappingInterceptor in Apache CXF before 2.5.8, 2.6.x before 2.6.5, and 2.7.x before 2.7.2, when using the WSS4JInInterceptor, bypasses WS-Security processing, which allows remote attackers to obtain access to SOAP services via an HTTP GET request.

CVSS 2.0 · 5.8 Medium EPSS 8.2% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Application Platform and 4 more
CVE-2012-5575

apache-cxf: XML encryption backwards compatibility attacks

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka "XML Encryption backwards compatibility attack."

CVSS 2.0 · 6.4 Medium EPSS 6.3% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Fuse Esb Enterprise Jboss Enterprise Application Platform and 5 more
CVE-2012-5370

jruby: Murmur hash function collisions (oCERT-2012-001)

JRuby computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4838.

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed
Vendors
Jruby Redhat
Products
Jruby Fuse Esb Enterprise Jboss Enterprise Soa Platform
CVE-2012-5055

Security: Ability to determine if username is valid via DaoAuthenticationProvider

DaoAuthenticationProvider in VMware SpringSource Spring Security before 2.0.8, 3.0.x before 3.0.8, and 3.1.x before 3.1.3 does not check the password if the user is not found, which makes the response delay shorter and might allow remote attackers to enumerate valid usernames via a series of login requests.

CVSS 2.0 · 5.0 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat Vmware
Products
Fuse Esb Enterprise Springsource Spring Security