Enterprise Application Platform CVEs and Security Vulnerabilities

CVE-2008-3273

JBossEAP status servlet info leak

JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true query string.

CVSS 2.0 · 5.0 Medium EPSS 47.1% KEV · Not listed

Vendors

Jboss Redhat

Products

Enterprise Application Platform Jboss Enterprise Application Platform Jboss Enterprise Web Platform

CVE-2016-2094

EAP: HTTPS NIO connector uses no timeout when reading SSL handshake from client

The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a read-timeout vulnerability.

CVSS 3.0 · 7.5 High EPSS 2.6% KEV · Not listed

Vendors

Jboss Redhat

Products

Enterprise Application Platform Jboss Enterprise Application Platform

Search vulnerabilities

JBossEAP status servlet info leak

EAP: HTTPS NIO connector uses no timeout when reading SSL handshake from client