Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 62

Export CSV
CVE-2013-4452

ON: World readable configuration files expose sensitive data

Red Hat JBoss Operations Network 3.1.2 uses world-readable permissions for the (1) server and (2) agent configuration files, which allows local users to obtain authentication credentials and other unspecified sensitive information by reading these files.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2013-4517

Java: Java XML Signature DoS Attack

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures.

CVSS 2.0 · 4.3 Medium EPSS 8.9% KEV · Not listed
Vendors
Apache Redhat
Products
Santuario Xml Security For Java Jboss Bpms Jboss Brms and 7 more
CVE-2011-3206

JON: Multiple XSS flaws

Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in RHQ 4.2.0, as used in JBoss Operations Network (aka JON or JBoss ON) before 3.0, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0 · 4.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat Rhq-project
Products
Jboss Operations Network Rhq
CVE-2012-5783

jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name

Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 3.0 · 3.7 Low EPSS 9.3% KEV · Not listed
Vendors
Apache Canonical Redhat
Products
Httpclient Ubuntu Linux Enterprise Linux and 9 more
CVE-2011-4858

tomcat: hash table collisions CPU usage DoS (oCERT-2011-003)

Apache Tomcat before 5.5.35, 6.x before 6.0.35, and 7.x before 7.0.23 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

CVSS 2.0 · 5.0 Medium EPSS 79.7% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Communications Platform and 7 more
CVE-2012-1100

JON: LDAP authentication allows any user access if bind credentials are bad

Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login to LDAP-based accounts via an arbitrary password in a login request.

CVSS 2.0 · 5.8 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2012-0022

tomcat: large number of parameters DoS

Apache Tomcat 5.5.x before 5.5.35, 6.x before 6.0.34, and 7.x before 7.0.23 uses an inefficient approach for handling parameters, which allows remote attackers to cause a denial of service (CPU consumption) via a request that contains many parameters and parameter values, a different vulnerability than CVE-2011-4858.

CVSS 2.0 · 5.0 Medium EPSS 10.5% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Communications Platform and 7 more
CVE-2013-2035

HawtJNI: predictable temporary file name leading to local arbitrary code execution

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Fuse Mq Enterprise Hawtjni Jboss Amq and 9 more
CVE-2013-2165

RichFaces: Remote code execution due to insecure deserialization

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called, which allows remote attackers to execute arbitrary code via crafted serialized data.

CVSS 2.0 · 7.5 High EPSS 12.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Brms Platform Jboss Enterprise Portal Platform and 6 more
CVE-2013-2172

Java: XML signature spoofing

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the CanonicalizationMethod parameter to specify an arbitrary weak "canonicalization algorithm to apply to the SignedInfo part of the Signature."

CVSS 2.0 · 4.3 Medium EPSS 5.9% KEV · Not listed
Vendors
Apache Redhat
Products
Santuario Xml Security For Java Fuse Esb Enterprise Fuse Management Console and 8 more
CVE-2013-2186

commons-fileupload: Arbitrary file upload via deserialization

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance.

CVSS 2.0 · 7.5 High EPSS 12.7% KEV · Not listed
Vendors
Redhat Ubuntu
Products
Jboss Enterprise Brms Platform Jboss Enterprise Portal Platform Jboss Enterprise Soa Platform and 4 more
CVE-2013-4002

OpenJDK: XML parsing Denial of Service (JAXP, 8017298)

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

CVSS 2.0 · 7.1 High EPSS 24.7% KEV · Not listed
Vendors
Apache Canonical Hp and 7 more
Products
Xerces2 Java Ubuntu Linux Hp-ux and 28 more
CVE-2013-4210

Remoting: DoS by file descriptor exhaustion

The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other products allows remote attackers to cause a denial of service (file descriptor consumption) via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 2.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Brms Platform Jboss Enterprise Soa Platform and 2 more
CVE-2020-14340

xnio: file descriptor leak caused by growing amounts of NIO Selector file handles may lead to DoS

A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial of service. It affects XNIO versions 3.6.0.Beta1 through 3.8.1.Final.

CVSS 3.1 · 5.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Oracle Redhat
Products
Communications Cloud Native Core Console Communications Cloud Native Core Network Repository Function Communications Cloud Native Core Policy and 13 more
CVE-2019-3834

JON: struts1 reversion of fix for CVE-2014-0114

It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

CVSS 3.1 · 7.3 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Operations Network
CVE-2018-8088

slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 later and in the 2.0.x series.

CVSS 3.1 · 9.8 Critical EPSS 14.7% KEV · Not listed
Vendors
Oracle Qos Redhat
Products
Goldengate Application Adapters Goldengate Stream Analytics Utilities Framework and 20 more
CVE-2018-1336

tomcat: A bug in the UTF-8 decoder can lead to DoS

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86.

CVSS 3.1 · 7.5 High EPSS 20.4% KEV · Not listed
Vendors
Apache Canonical Debian and 1 more
Products
Tomcat Ubuntu Linux Debian Linux and 9 more
CVE-2018-12533

RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

CVSS 3.0 · 9.8 Critical EPSS 18.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Operations Network Richfaces
CVE-2012-5626

JBoss - EJB method invocation ignores roles specified using the @RunAs annotation

EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Brms Jboss Enterprise Application Platform Jboss Enterprise Web Server and 3 more