Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 64

Export CSV
CVE-2017-2658

Dashbuilder: Lack of clickjacking protection on the login page

It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & Services before 6.4.3 could be opened in an IFRAME, which made it possible to intercept and manipulate requests. An attacker could use this flaw to trick a user into performing arbitrary actions in the Console (clickjacking).

CVSS 3.0 · 2.6 Low EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpm Suite Jboss Bpms Jboss Data Virtualization and 1 more
CVE-2016-6814

Groovy: Remote code execution via deserialization

When an application with unsupported Codehaus versions of Groovy from 1.7.0 to 2.4.3, Apache Groovy 2.4.4 to 2.4.7 on classpath uses standard Java serialization mechanisms, e.g. to communicate between servers or to store local data, it was possible for an attacker to bake a special serialized object that will execute code directly when deserialized. All applications which rely on serialization and do not isolate the code which deserializes objects were subject to this vulnerability.

CVSS 3.0 · 9.8 Critical EPSS 17.2% KEV · Not listed
Vendors
Apache Redhat
Products
Groovy Enterprise Linux Enterprise Linux Server and 4 more
CVE-2016-6343

Dashbuilder: Reflected XSS

JBoss BPM Suite 6 is vulnerable to a reflected XSS via dashbuilder. Remote attackers can entice authenticated users that have privileges to access dashbuilder (usually admins) to click on links to /dashbuilder/Controller containing malicious scripts. Successful exploitation would allow execution of script code within the context of the affected user.

CVSS 3.0 · 6.1 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpm Suite Jboss Bpms Jboss Data Virtualization
CVE-2016-5397

thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands

The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older, Fixed in Apache Thrift 0.10.0.

CVSS 3.0 · 8.8 High EPSS 6.9% KEV · Not listed
Vendors
Apache Redhat
Products
Thrift Jboss Data Virtualization Jboss Fuse