Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 105

Export CSV
CVE-2014-3612

JAAS: LDAPLoginModule allows empty password authentication

The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. NOTE: this identifier has been SPLIT per ADT2 due to different vulnerability types. See CVE-2015-6524 for the use of wildcard operators in usernames.

CVSS 2.0 · 7.5 High EPSS 6.9% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Fuse Esb Enterprise Fuse Management Console and 3 more
CVE-2014-3623

CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods

Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does not properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vectors.

CVSS 2.0 · 5.0 Medium EPSS 9.2% KEV · Not listed
Vendors
Apache Redhat
Products
Cxf Wss4j Jboss Amq and 5 more
CVE-2014-3625

Framework: directory traversal flaw

Directory traversal vulnerability in Pivotal Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CVSS 2.0 · 5.0 Medium EPSS 9.9% KEV · Not listed
Vendors
Pivotal Software Redhat Vmware
Products
Spring Framework Jboss Amq Jboss Bpms and 4 more
CVE-2014-8175

Fuse: insufficient access permissions checks when accessing Hawtio console

Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveraging an account defined in the users.properties file.

CVSS 2.0 · 6.0 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Jboss Amq Jboss Fuse
CVE-2015-0227

wss4j: Apache WSS4J doesn't correctly enforce the requireSignedEncryptedDataElements property

Apache WSS4J before 1.6.17 and 2.x before 2.0.2 allows remote attackers to bypass the requireSignedEncryptedDataElements configuration via a vectors related to "wrapping attacks."

CVSS 2.0 · 5.0 Medium EPSS 7.5% KEV · Not listed
Vendors
Apache Redhat
Products
Wss4j Jboss Amq Jboss Data Grid and 3 more
CVE-2015-0263

Camel: XXE in via SAXSource expansion

XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.

CVSS 2.0 · 5.0 Medium EPSS 7.5% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Jboss Amq Jboss Bpms and 3 more
CVE-2015-0264

Camel: XXE via XPath expression evaluation

Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.

CVSS 2.0 · 5.0 Medium EPSS 7.1% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Jboss Amq Jboss Bpms and 3 more
CVE-2015-1796

Java: PKIX Trust Engines Exhibit Critical Flaw In Trusted Names Evaluation

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.

CVSS 2.0 · 4.3 Medium EPSS 1.2% KEV · Not listed
Vendors
Redhat Shibboleth
Products
Jboss Amq Jboss Fuse Identity Provider and 1 more
CVE-2015-3192

Framework: denial-of-service attack with XML input

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

CVSS 3.0 · 5.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Pivotal Software Redhat and 1 more
Products
Fedora Spring Framework Jboss Amq and 5 more
CVE-2015-3253

groovy: remote execution of untrusted code in class MethodClosure

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

CVSS 3.0 · 9.8 Critical EPSS 41.0% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Groovy Health Sciences Clinical Development Center Retail Order Broker Cloud Service and 11 more
CVE-2015-5254

ObjectMessage: unsafe deserialization

Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.

CVSS 3.0 · 9.8 Critical EPSS 38.2% KEV · Not listed
Vendors
Apache Fedoraproject Redhat
Products
Activemq Fedora Jboss Amq and 2 more
CVE-2015-7940

bouncycastle: Invalid curve attack allowing to extract private keys

The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."

CVSS 3.0 · 3.7 Low EPSS 4.7% KEV · Not listed
Vendors
Bouncycastle Opensuse Oracle and 1 more
Products
Bouncy Castle Crypto Package Leap Opensuse and 6 more
CVE-2016-0734

activemq: Clickjacking in Web Console

The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.

CVSS 3.0 · 6.1 Medium EPSS 8.6% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Jboss Amq Jboss Fuse
CVE-2016-0782

activemq: Cross-site scripting vulnerabilities in web console

The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.

CVSS 3.0 · 5.4 Medium EPSS 6.1% KEV · Not listed
Vendors
Apache Redhat
Products
Activemq Jboss Amq Jboss Fuse
CVE-2016-2175

pdfbox: XML External Entity vulnerability

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

CVSS 3.0 · 7.8 High EPSS 3.8% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Pdfbox Debian Linux Jboss Amq and 4 more
CVE-2016-9878

Framework: Directory Traversal in the Spring Framework ResourceServlet

An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. Paths provided to the ResourceServlet were not properly sanitized and as a result exposed to directory traversal attacks.

CVSS 3.0 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Pivotal Software Redhat Vmware
Products
Spring Framework Jboss Amq Jboss Fuse and 1 more
CVE-2013-6429

Framework: XML External Entity (XXE) injection flaw

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External Entity (XXE) issue, and a different vulnerability than CVE-2013-4152 and CVE-2013-7315.

CVSS 2.0 · 6.8 Medium EPSS 90.6% KEV · Not listed
Vendors
Pivotal Software Redhat Vmware
Products
Spring Framework Jboss Amq Jboss Fuse and 1 more
CVE-2013-2035

HawtJNI: predictable temporary file name leading to local arbitrary code execution

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwriting a temporary JAR file with a predictable name in /tmp.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Fuse Mq Enterprise Hawtjni Jboss Amq and 9 more
CVE-2013-2192

hadoop: man-in-the-middle vulnerability

The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirectional authentication and obtain sensitive information by forcing a downgrade to simple authentication.

CVSS 2.0 · 3.2 Low EPSS 1.1% KEV · Not listed
Vendors
Apache Redhat
Products
Hadoop Jboss Amq Jboss Fuse and 1 more