Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 105

Export CSV
CVE-2016-8749

camel-jacksonxml: Unmarshalling operation are vulnerable to RCE

Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.

CVSS 3.0 · 9.8 Critical EPSS 10.6% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Jboss Amq Jboss Fuse
CVE-2017-5929

logback: Serialization vulnerability in SocketServer and ServerSocketReceiver

QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components.

CVSS 3.1 · 9.8 Critical EPSS 7.5% KEV · Not listed
Vendors
Qos Redhat
Products
Logback Jboss Amq Jboss Bpms and 4 more
CVE-2017-5662

batik: XML external entity processing vulnerability

In Apache Batik before 1.9, files lying on the filesystem of the server which uses batik can be revealed to arbitrary users who send maliciously formed SVG files. The file types that can be shown depend on the user context in which the exploitable application is running. If the user is root a full compromise of the server - including confidential or sensitive files - would be possible. XXE can also be used to attack the availability of the server via denial of service as the references within a xml document can trivially trigger an amplification attack.

CVSS 3.0 · 7.3 High EPSS 4.1% KEV · Not listed
Vendors
Apache Redhat
Products
Batik Jboss Amq Jboss Bpms and 2 more
CVE-2016-9177

Spark: Directory traversal vulnerability in version 2.5

Directory traversal vulnerability in Spark 2.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.

CVSS 3.0 · 7.5 High EPSS 5.1% KEV · Not listed
Vendors
Redhat Sparkjava
Products
Jboss Amq Jboss Fuse Spark
CVE-2014-0002

Camel: XML eXternal Entity (XXE) flaw in XSLT component

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 7.5 High EPSS 27.4% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Fuse Esb Enterprise Fuse Management Console and 6 more
CVE-2014-0003

Camel: remote code execution via XSL

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message.

CVSS 2.0 · 7.5 High EPSS 7.5% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Fuse Esb Enterprise Fuse Management Console and 7 more
CVE-2014-0034

CXF: The SecurityTokenService accepts certain invalid SAML Tokens as valid

The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to gain access via an invalid SAML token.

CVSS 2.0 · 4.3 Medium EPSS 7.4% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0035

CXF: UsernameTokens are sent in plaintext with a Symmetric EncryptBeforeSigning policy

The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken, transmits the UsernameToken in cleartext, which allows remote attackers to obtain sensitive information by sniffing the network.

CVSS 2.0 · 4.3 Medium EPSS 7.1% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0054

Framework: incomplete fix for CVE-2013-7315/CVE-2013-6429

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4152, CVE-2013-7315, and CVE-2013-6429.

CVSS 2.0 · 6.8 Medium EPSS 91.4% KEV · Not listed
Vendors
Redhat Springsource Vmware
Products
Jboss Amq Jboss Fuse Spring Framework and 1 more
CVE-2014-0074

Shiro: successful authentication without specifying user name or password

Apache Shiro 1.x before 1.2.3, when using an LDAP server with unauthenticated bind enabled, allows remote attackers to bypass authentication via an empty (1) username or (2) password.

CVSS 2.0 · 7.5 High EPSS 5.5% KEV · Not listed
Vendors
Apache Redhat
Products
Shiro Fuse Esb Enterprise Fuse Management Console and 3 more
CVE-2014-0085

Fuse: admin user cleartext password appears in logging

JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper. This permitted sensitive information disclosure via logging to local users. Note: this description has been updated; previous text mistakenly identified the source of the flaw as Zookeeper. Previous text: Apache Zookeeper logs cleartext admin passwords, which allows local users to obtain sensitive information by reading the log.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss A-mq Jboss Amq Jboss Fuse
CVE-2014-0107

Xalan-Java: insufficient constraints in secure processing feature

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

CVSS 2.0 · 7.5 High EPSS 14.1% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Xalan-java Webcenter Sites Enterprise Linux and 12 more
CVE-2014-0109

CXF: HTML content posted to SOAP endpoint could cause OOM errors

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large request with the Content-Type set to text/html to a SOAP endpoint, which triggers an error.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0110

CXF: Large invalid content could cause temporary space to fill

Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large invalid SOAP message.

CVSS 2.0 · 4.3 Medium EPSS 3.6% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Jboss Amq Jboss Bpms and 4 more
CVE-2014-0168

Jolokia: cross-site request forgery (CSRF)

Cross-site request forgery (CSRF) vulnerability in Jolokia before 1.2.1 allows remote attackers to hijack the authentication of users for requests that execute MBeans methods via a crafted web page.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Jolokia Redhat
Products
Jolokia Jboss Amq Jboss Fuse
CVE-2014-0193

netty: DoS via memory exhaustion during data aggregation

WebSocket08FrameDecoder in Netty 3.6.x before 3.6.9, 3.7.x before 3.7.1, 3.8.x before 3.8.2, 3.9.x before 3.9.1, and 4.0.x before 4.0.19 allows remote attackers to cause a denial of service (memory consumption) via a TextWebSocketFrame followed by a long stream of ContinuationWebSocketFrames.

CVSS 2.0 · 5.0 Medium EPSS 4.3% KEV · Not listed
Vendors
Netty Redhat
Products
Netty Jboss Amq Jboss Bpms and 7 more
CVE-2014-1904

Framework: cross-site scripting flaw when using Spring MVC

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the requested URI in a default action.

CVSS 2.0 · 4.3 Medium EPSS 6.9% KEV · Not listed
Vendors
Pivotal Software Redhat
Products
Spring Framework Jboss Amq Jboss Fuse
CVE-2014-3577

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

CVSS 3.0 · 4.8 Medium EPSS 9.2% KEV · Not listed
Vendors
Apache Redhat
Products
Httpasyncclient Httpclient Enterprise Linux and 15 more