Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 56

Export CSV
CVE-2015-0254

jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags

Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity (XXE) attacks via a crafted XSLT extension in a (1) <x:parse> or (2) <x:transform> JSTL XML tag.

CVSS 3.0 · 7.6 High EPSS 12.0% KEV · Not listed
Vendors
Apache Canonical Redhat
Products
Standard Taglibs Ubuntu Linux Enterprise Linux and 2 more
CVE-2012-5887

tomcat: three DIGEST authentication implementation issues

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 does not properly check for stale nonce values in conjunction with enforcement of proper credentials, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests.

CVSS 2.0 · 5.0 Medium EPSS 12.1% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Data Grid and 5 more
CVE-2012-5886

tomcat: three DIGEST authentication implementation issues

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 caches information about the authenticated user within the session state, which makes it easier for remote attackers to bypass authentication via vectors related to the session ID.

CVSS 2.0 · 5.0 Medium EPSS 8.8% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Data Grid and 5 more
CVE-2012-5885

tomcat: three DIGEST authentication implementation issues

The replay-countermeasure functionality in the HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.36, 6.x before 6.0.36, and 7.x before 7.0.30 tracks cnonce (aka client nonce) values instead of nonce (aka server nonce) and nc (aka nonce-count) values, which makes it easier for remote attackers to bypass intended access restrictions by sniffing the network for valid requests, a different vulnerability than CVE-2011-1184.

CVSS 2.0 · 5.0 Medium EPSS 9.0% KEV · Not listed
Vendors
Apache Redhat
Products
Tomcat Enterprise Linux Jboss Data Grid and 5 more
CVE-2013-7285

XStream: remote code execution due to insecure XML deserialization

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON.

CVSS 3.1 · 9.8 Critical EPSS 84.4% KEV · Not listed
Vendors
Apache Oracle Redhat and 1 more
Products
Activemq Endeca Information Discovery Studio Fuse Esb Enterprise and 14 more
CVE-2018-14667

RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution

The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource. A remote, unauthenticated attacker could exploit this to execute arbitrary code using a chain of java serialized objects via org.ajax4jsf.resource.UserResource$UriData.

CVSS 3.1 · 9.8 Critical EPSS 70.8% KEV · Listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Brms Platform and 2 more
CVE-2023-1932

Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss

A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Hibernate Redhat
Products
Hibernate-validator A Mq Clients Amq Broker and 21 more
CVE-2015-7501

apache-commons-collections: InvokerTransformer code execution during deserialisation

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

CVSS 3.0 · 9.8 Critical EPSS 85.6% KEV · Not listed
Vendors
Redhat
Products
Data Grid Enterprise Linux Jboss A-mq and 19 more
CVE-2015-0226

wss4j: Apache WSS4J is vulnerable to Bleichenbacher's attack (incomplete fix for CVE-2011-2487)

Apache WSS4J before 1.6.17 and 2.0.x before 2.0.2 improperly leaks information about decryption failures when decrypting an encrypted key or message data, which makes it easier for remote attackers to recover the plaintext form of a symmetric key via a series of crafted messages. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-2487.

CVSS 3.0 · 7.5 High EPSS 5.5% KEV · Not listed
Vendors
Apache Redhat
Products
Wss4j Jboss Amq Jboss Data Grid and 4 more
CVE-2016-2141

JGroups: Authorization bypass

It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the cluster, leading to information disclosure, message spoofing, or further possible attacks.

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Data Grid Jboss Data Virtualization and 8 more
CVE-2015-3253

groovy: remote execution of untrusted code in class MethodClosure

The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

CVSS 3.0 · 9.8 Critical EPSS 41.0% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Groovy Health Sciences Clinical Development Center Retail Order Broker Cloud Service and 11 more
CVE-2014-3577

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

CVSS 3.0 · 4.8 Medium EPSS 9.2% KEV · Not listed
Vendors
Apache Redhat
Products
Httpasyncclient Httpclient Enterprise Linux and 15 more
CVE-2014-3530

PicketLink: XXE via insecure DocumentBuilderFactory usage

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.

CVSS 2.0 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Bpms Jboss Brms Jboss Data Grid and 7 more
CVE-2016-2510

bsh2: remote code execution via deserialization

BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

CVSS 3.1 · 8.1 High EPSS 70.4% KEV · Not listed
Vendors
Beanshell Canonical Debian and 1 more
Products
Beanshell Ubuntu Linux Debian Linux and 5 more
CVE-2014-3604

SSL: Hostname verification susceptible to MITM attack

Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVSS 2.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Not Yet Commons Ssl Project Redhat
Products
Not Yet Commons Ssl Jboss Enterprise Soa Platform
CVE-2012-6153

CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.

CVSS 2.0 · 4.3 Medium EPSS 5.8% KEV · Not listed
Vendors
Apache Redhat
Products
Commons-httpclient Developer Toolset Jboss Bpms and 10 more
CVE-2014-0107

Xalan-Java: insufficient constraints in secure processing feature

The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESSING is enabled, which allows remote attackers to bypass expected restrictions and load arbitrary classes or access external resources via a crafted (1) xalan:content-header, (2) xalan:entities, (3) xslt:content-header, or (4) xslt:entities property, or a Java property that is bound to the XSLT 1.0 system-property function.

CVSS 2.0 · 7.5 High EPSS 14.1% KEV · Not listed
Vendors
Apache Oracle Redhat
Products
Xalan-java Webcenter Sites Enterprise Linux and 12 more
CVE-2014-0248

Seam: RCE via unsafe logging in AuthenticationFilter

org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging.

CVSS 2.0 · 6.8 Medium EPSS 3.5% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Soa Platform Jboss Enterprise Web Framework and 2 more
CVE-2014-3518

5: Remote code execution via unauthenticated JMX/RMI connector

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to execute arbitrary code via unspecified vectors.

CVSS 2.0 · 6.8 Medium EPSS 2.6% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Brms Platform Jboss Enterprise Portal Platform and 1 more
CVE-2012-0034

Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs

The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by reading the log file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Enterprise Application Platform Jboss Enterprise Brms Platform Jboss Enterprise Soa Platform and 1 more