Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 721

Export CSV
CVE-2018-14642

undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.

CVSS 3.1 · 5.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Single Sign On and 1 more
CVE-2018-14627

JBoss/WildFly: iiop does not honour strict transport confidentiality

The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections: <transport-config confidentiality="required" trust-in-target="supported"/>

CVSS 3.0 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Single Sign On Wildfly
CVE-2018-14371

mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter

The getLocalePrefix function in ResourceManager.java in Eclipse Mojarra before 2.3.7 is affected by Directory Traversal via the loc parameter. A remote attacker can download configuration files or Java bytecodes from applications.

CVSS 3.0 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Eclipse Redhat
Products
Mojarra Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 1 more
CVE-2018-12533

RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310.

CVSS 3.0 · 9.8 Critical EPSS 18.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Operations Network Richfaces
CVE-2018-10934

wildfly-core: Cross-site scripting (XSS) in JBoss Management Console

A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Server Jboss Enterprise Application Platform Jboss Single Sign On and 1 more
CVE-2018-10862

wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

CVSS 3.0 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Data Grid Jboss Enterprise Application Platform and 5 more
CVE-2018-10237

guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

CVSS 3.1 · 5.9 Medium EPSS 8.4% KEV · Not listed
Vendors
Google Oracle Redhat
Products
Guava Banking Payments Communications Ip Service Activator and 18 more
CVE-2018-1000632

dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later.

CVSS 3.1 · 7.5 High EPSS 6.6% KEV · Not listed
Vendors
Debian Dom4j Project Netapp and 2 more
Products
Debian Linux Dom4j Oncommand Workflow Automation and 14 more
CVE-2017-7559

undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666)

In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

CVSS 3.0 · 6.1 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Amq Jboss Enterprise Application Platform Jboss Fuse and 1 more
CVE-2017-7536

hibernate-validator: Privilege escalation when running under the security manager

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege escalation can occur. By allowing the calling code to access those private members without the permission an attacker may be able to validate an invalid instance and access the private member value via ConstraintViolation#getInvalidValue().

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Hibernate Validator Jboss Amq and 6 more
CVE-2017-7465

JBoss: JAXP in EAP 7.0 allows RCE via XSL

It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing. Doing a transform in JAXP requires the use of a 'javax.xml.transform.TransformerFactory'. If the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability.

CVSS 3.0 · 9 Critical EPSS 2.8% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd
CVE-2017-7464

JBoss: JAXP in EAP 7.0 allows info disclosure via XXE

It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing.

CVSS 3.0 · 8.7 High EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform
CVE-2017-2670

undertow: IO thread DoS via unclean Websocket closing

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

CVSS 3.0 · 7.5 High EPSS 3.6% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Enterprise Linux Jboss Data Grid and 3 more
CVE-2017-2666

undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests

It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.

CVSS 3.0 · 6.5 Medium EPSS 3.1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Enterprise Linux Jboss Enterprise Application Platform and 1 more
CVE-2017-2582

keycloak: SAML request parser replaces special strings with system properties

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Keycloak