Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 136

Export CSV
CVE-2014-7827

Security: Wrong security context loaded when using SAML2 STS Login Module

The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default security domain when a security domain is undefined, which allows remote authenticated users to bypass intended access restrictions by leveraging credentials on the default domain for a role that is also on the application domain.

CVSS 2.0 · 3.5 Low EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform
CVE-2014-7839

RESTeasy: External entities expanded by DocumentProvider

DocumentProvider in RESTEasy 2.3.7 and 3.0.9 does not configure the (1) external-general-entities or (2) external-parameter-entities features, which allows remote attackers to conduct XML external entity (XXE) attacks via unspecified vectors.

CVSS 2.0 · 6.4 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 4 more
CVE-2014-8114

UberFire: Information disclosure and RCE via insecure file upload/download servlets

The UberFire Framework 0.3.x does not properly restrict paths, which allows remote attackers to (1) execute arbitrary code by uploading crafted content to FileUploadServlet or (2) read arbitrary files via vectors involving FileDownloadServlet.

CVSS 2.0 · 6.8 Medium EPSS 3.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Uberfire
CVE-2014-8122

Weld: Limited information disclosure via stale thread state

Race condition in JBoss Weld before 2.2.8 and 3.x before 3.0.0 Alpha3 allows remote attackers to obtain information from a previous conversation via vectors related to a stale thread state.

CVSS 2.0 · 4.3 Medium EPSS 2.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 4 more
CVE-2014-8125

jBPM: BPMN2 file processing XXE in Process Execution

XML external entity (XXE) vulnerability in Drools and jBPM before 6.2.0 allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted BPMN2 file.

CVSS 2.0 · 7.5 High EPSS 2.6% KEV · Not listed
Vendors
Redhat
Products
Drools Jboss Bpms Jboss Brms and 1 more
CVE-2015-0250

batik: XML External Entity (XXE) injection in SVG parsing

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG file.

CVSS 2.0 · 6.4 Medium EPSS 16.6% KEV · Not listed
Vendors
Apache Canonical Redhat
Products
Batik Ubuntu Linux Jboss Bpms and 2 more
CVE-2015-0263

Camel: XXE in via SAXSource expansion

XML external entity (XXE) vulnerability in the XML converter setup in converter/jaxp/XmlConverter.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allows remote attackers to read arbitrary files via an external entity in an SAXSource.

CVSS 2.0 · 5.0 Medium EPSS 7.5% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Jboss Amq Jboss Bpms and 3 more
CVE-2015-0264

Camel: XXE via XPath expression evaluation

Multiple XML external entity (XXE) vulnerabilities in builder/xml/XPathBuilder.java in Apache Camel before 2.13.4 and 2.14.x before 2.14.2 allow remote attackers to read arbitrary files via an external entity in an invalid XML (1) String or (2) GenericFile object in an XPath query.

CVSS 2.0 · 5.0 Medium EPSS 7.1% KEV · Not listed
Vendors
Apache Redhat
Products
Camel Jboss Amq Jboss Bpms and 3 more
CVE-2015-1818

dashbuilder: XXE/SSRF vulnerability

XML external entity (XXE) vulnerability in the dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery (SSRF) attacks, and have other unspecified impact via a crafted XML document.

CVSS 2.0 · 7.5 High EPSS 2.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpm Suite Jboss Bpms Jboss Data Virtualization
CVE-2015-3192

Framework: denial-of-service attack with XML input

Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a crafted XML file.

CVSS 3.0 · 5.5 Medium EPSS 2.6% KEV · Not listed
Vendors
Fedoraproject Pivotal Software Redhat and 1 more
Products
Fedora Spring Framework Jboss Amq and 5 more
CVE-2016-2175

pdfbox: XML External Entity vulnerability

Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to conduct XML External Entity (XXE) attacks via a crafted PDF.

CVSS 3.0 · 7.8 High EPSS 3.8% KEV · Not listed
Vendors
Apache Debian Redhat
Products
Pdfbox Debian Linux Jboss Amq and 4 more
CVE-2016-2510

bsh2: remote code execution via deserialization

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

CVSS 3.1 · 8.1 High EPSS 70.4% KEV · Not listed
Vendors
Beanshell Canonical Debian and 1 more
Products
Beanshell Ubuntu Linux Debian Linux and 5 more
CVE-2016-4999

Dashbuilder: SQL Injection on data set lookup filters

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.

CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Vendors
Redhat
Products
Dashbuilder Jboss Bpm Suite Jboss Bpms and 1 more
CVE-2016-5398

stored XSS in JBoss BPM suite business process editor

Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated users to inject arbitrary web script or HTML by levering permission to create business processes.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpm Suite Jboss Bpms Jboss Enterprise Brms Platform
CVE-2016-6344

JBoss bpms 6.3.x cookie does not set httponly

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.

CVSS 3.0 · 5.3 Medium EPSS 2.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpm Suite Jboss Bpms Jboss Enterprise Brms Platform
CVE-2016-7033

bpms: stored XSS in dashbuilder

Multiple cross-site scripting (XSS) vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 3.0 · 6.1 Medium EPSS 1.5% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpm Suite Jboss Bpms
CVE-2016-7034

Dashbuilder: insecure handling of CSRF token

The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to (1) bypass CSRF protection mechanisms or (2) conduct cross-site request forgery (CSRF) attacks by obtaining an old token.

CVSS 3.0 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpm Suite Jboss Bpms Jboss Data Virtualization
CVE-2011-5245

RESTEasy: XML eXternal Entity (XXE) flaw

The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.

CVSS 2.0 · 5.0 Medium EPSS 3.2% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Enterprise Application Platform and 6 more