Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 91

Export CSV
CVE-2020-27782

undertow: special character in query results in server errors

A flaw was found in the Undertow AJP connector. Malicious requests and abrupt connection closes could be triggered by an attacker using query strings with non-RFC compliant characters resulting in a denial of service. The highest threat from this vulnerability is to system availability. This affects Undertow 2.1.5.SP1, 2.0.33.SP2, and 2.2.3.SP1.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Camel Quarkus Integration Jboss Enterprise Application Platform and 5 more
CVE-2020-25644

wildfly-openssl: memory leak per HTTP session creation in WildFly OpenSSL

A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 7.5 High EPSS 2.4% KEV · Not listed
Vendors
Netapp Redhat
Products
Oncommand Insight Oncommand Workflow Automation Service Level Manager and 9 more
CVE-2020-1757

undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass

A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path after semicolon which may lead to an application mapping resulting in the security bypass.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus and 5 more
CVE-2020-1745

undertow: AJP File Read/Inclusion Vulnerability

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.

CVSS 3.1 · 8.6 High EPSS 5.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 5 more
CVE-2020-10740

wildfly: unsafe deserialization in Wildfly Enterprise Java Beans

A vulnerability was found in Wildfly in versions before 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.

CVSS 3.1 · 6.6 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd Jboss Enterprise Application Platform Eus and 4 more
CVE-2019-9512

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to ping floods, potentially leading to a denial of service. The attacker sends continual pings to an HTTP/2 peer, causing the peer to build an internal queue of responses. Depending on how efficiently this data is queued, this can consume excess CPU, memory, or both.

CVSS 3.1 · 7.5 High EPSS 83.4% KEV · Not listed
Vendors
Apache Apple Canonical and 3 more
Products
Traffic Server Mac Os X Swiftnio and 21 more
CVE-2019-14888

undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS

A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Jboss Data Grid Jboss Enterprise Application Platform and 7 more
CVE-2019-14843

wildfly-security-manager: security manager authorization bypass

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped with Red Hat Jboss EAP 7 and Red Hat SSO 7 are vulnerable to this issue.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus Jboss Single Sign On and 2 more
CVE-2019-10174

infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

CVSS 3.1 · 8.8 High EPSS 3.1% KEV · Not listed
Vendors
Infinispan Netapp Redhat
Products
Infinispan Active Iq Unified Manager Enterprise Linux and 9 more