Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 206

Export CSV
CVE-2024-1459

Undertow: directory traversal vulnerability

A path traversal vulnerability was found in Undertow. This issue may allow a remote attacker to append a specially-crafted sequence to an HTTP request for an application deployed to JBoss EAP, which may permit access to privileged or restricted files and directories.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Data Grid Jboss Enterprise Application Platform and 5 more
CVE-2023-6717

Keycloak: xss via assertion consumer service url in saml post-binding flow

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This issue may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission. This can enable unauthorized access and harmful actions, compromising the confidentiality, integrity, and availability of the complete KC instance.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Build Keycloak Jboss Bpms and 13 more
CVE-2023-5379

Undertow: ajp request closes connection exceeding maxrequestsize

A flaw was found in Undertow. When an AJP request is sent that exceeds the max-header-size attribute in ajp-listener, JBoss EAP is marked in an error state by mod_cluster in httpd, causing JBoss EAP to close the TCP connection without returning an AJP response. This happens because mod_proxy_cluster marks the JBoss EAP instance as an error worker when the TCP connection is closed from the backend after sending the AJP request without receiving an AJP response, and stops forwarding. This issue could allow a malicious user could to repeatedly send requests that exceed the max-header-size, causing a Denial of Service (DoS).

CVSS 3.1 · 7.5 High EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Data Grid Jboss Enterprise Application Platform and 8 more
CVE-2024-1249

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Amq Streams Build Keycloak and 12 more
CVE-2024-1132

Keycloak: path transversal in redirection validation

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Amq Broker Build Keycloak Build Of Keycloak and 20 more
CVE-2023-6291

Keycloak: redirect_uri validation bypass

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Enterprise Linux Jboss Bpms and 15 more
CVE-2018-14721

jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

CVSS 3.0 · 10.0 Critical EPSS 10.5% KEV · Not listed
Vendors
Debian Fasterxml Oracle and 1 more
Products
Debian Linux Jackson-databind Banking Platform and 18 more
CVE-2018-14720

jackson-databind: exfiltration/XXE in some JDK classes

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

CVSS 3.0 · 9.8 Critical EPSS 7.5% KEV · Not listed
Vendors
Debian Fasterxml Oracle and 1 more
Products
Debian Linux Jackson-databind Banking Platform and 18 more
CVE-2018-12023

jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver

An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle JDBC jar in the classpath, and an attacker can provide an LDAP service to access, it is possible to make the service execute a malicious payload.

CVSS 3.0 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Debian Fasterxml Fedoraproject and 2 more
Products
Debian Linux Jackson-databind Fedora and 17 more
CVE-2012-5887

tomcat: three DIGEST authentication implementation issues

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

CVSS 2.0 · 5.0 Medium EPSS 12.1% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Data Grid and 5 more
CVE-2012-5886

tomcat: three DIGEST authentication implementation issues

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

CVSS 2.0 · 5.0 Medium EPSS 8.8% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Data Grid and 5 more
CVE-2012-5885

tomcat: three DIGEST authentication implementation issues

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

CVSS 2.0 · 5.0 Medium EPSS 9.0% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Data Grid and 5 more
CVE-2021-21290

Local Information Disclosure Vulnerability in Netty on Unix-Like systems due temporary files

Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty before version 4.1.59.Final there is a vulnerability on Unix-like systems involving an insecure temp file. When netty's multipart decoders are used local information disclosure can occur via the local system temporary directory if temporary storing uploads on the disk is enabled. On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Operating Systems. The method "File.createTempFile" on unix-like systems creates a random file, but, by default will create this file with the permissions "-rw-r--r--". Thus, if sensitive information is written to this file, other local users can read this information. This is the case in netty's "AbstractDiskHttpData" is vulnerable. This has been fixed in version 4.1.59.Final. As a workaround, one may specify your own "java.io.tmpdir" when you start the JVM or use "DefaultHttpDataFactory.setBaseDir(...)" to set the directory to something that is only readable by the current user.

CVSS 3.1 · 6.2 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Netapp Netty and 3 more
Products
Debian Linux Active Iq Unified Manager Cloud Secure Agent and 24 more
CVE-2019-20445

netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVSS 3.1 · 9.1 Critical EPSS 13.8% KEV · Not listed
Vendors
Apache Canonical Debian and 3 more
Products
Spark Ubuntu Linux Debian Linux and 17 more
CVE-2019-20444

netty: HTTP request smuggling

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

CVSS 3.1 · 9.1 Critical EPSS 8.9% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 16 more
CVE-2019-16869

netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers

Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

CVSS 3.1 · 7.5 High EPSS 8.6% KEV · Not listed
Vendors
Canonical Debian Netty and 1 more
Products
Ubuntu Linux Debian Linux Netty and 11 more
CVE-2019-14893

jackson-databind: Serialization gadgets in classes of the xalan package

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

CVSS 3.1 · 9.8 Critical EPSS 4.1% KEV · Not listed
Vendors
Fasterxml Netapp Oracle and 1 more
Products
Jackson-databind Oncommand Api Services Steelstore Cloud Integrated Storage and 9 more