Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 7

Export CSV
CVE-2026-24330

Wildfly-core: wildfly: arbitrary file read via malicious archive deployment

A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Fuse 7 Jboss Bpms Jboss Enterprise Application Platform and 7 more
CVE-2025-23368

Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli

A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks via CLI.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Camel K Data Grid and 8 more
CVE-2023-4061

Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor

A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildfly system. This issue could allow a malicious user to access the system and obtain possible sensitive information from the system.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Wildfly Core
CVE-2021-3717

wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfly-core versions prior to 17.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Enterprise Application Platform Jboss Enterprise Application Platform Eus and 6 more
CVE-2021-3629

undertow: potential security issue in flow control over HTTP/2 may lead to DOS

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and prior to 2.2.11.Final.

CVSS 3.1 · 5.9 Medium EPSS 1.3% KEV · Not listed
Vendors
Netapp Redhat
Products
Active Iq Unified Manager Oncommand Insight Oncommand Workflow Automation and 11 more
CVE-2019-14838

wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default

A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server

CVSS 3.1 · 4.9 Medium EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Data Grid Enterprise Linux Jboss Data Grid and 7 more
CVE-2018-10862

wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

CVSS 3.0 · 5.5 Medium EPSS 1.3% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Jboss Data Grid Jboss Enterprise Application Platform and 5 more