Jboss_enterprise_application_platform
(Redhat)| Repositories |
•
https://github.com/FasterXML/jackson-databind
• https://github.com/qos-ch/slf4j • https://github.com/bcgit/bc-java • https://github.com/apache/cxf • https://github.com/wildfly-security/jboss-negotiation |
| #Vulnerabilities | 133 |
| Date | ID | Summary | Products | Score | Patch |
|---|---|---|---|---|---|
| 2019-10-14 | CVE-2019-14838 | A flaw was found in wildfly-core before 7.2.5.GA. The Management users with Monitor, Auditor and Deployer Roles should not be allowed to modify the runtime state of the server | Jboss_enterprise_application_platform, Wildfly_core | N/A | |
| 2019-11-18 | CVE-2019-10172 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes. | Jackson\-Mapper\-Asl, Jboss_enterprise_application_platform, Jboss_fuse | N/A | |
| 2019-11-08 | CVE-2019-10219 | A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. | Hibernate\-Validator, Jboss_data_grid, Jboss_enterprise_application_platform, Single_sign\-On | N/A | |
| 2016-09-01 | CVE-2016-2183 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. | Content_security_management_appliance, Openssl, Database, Python, Enterprise_linux, Jboss_enterprise_application_platform, Jboss_enterprise_web_server, Jboss_web_server | 7.5 | |
| 2018-05-21 | CVE-2018-1067 | In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value. | Jboss_enterprise_application_platform, Undertow, Virtualization | 6.1 | |
| 2018-01-24 | CVE-2018-1047 | A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files. | Jboss_enterprise_application_platform, Jboss_wildfly_application_server | 5.5 | |
| 2018-02-15 | CVE-2018-1041 | A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer. An attacker could use this flaw to cause denial of service via high CPU caused by an infinite loop. | Jboss\-Remoting, Jboss_enterprise_application_platform | 7.5 | |
| 2017-05-19 | CVE-2017-7504 | HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not restrict the classes for which it performs deserialization, which allows remote attackers to execute arbitrary code via crafted serialized data. | Jboss_enterprise_application_platform | 9.8 | |
| 2018-06-27 | CVE-2017-7465 | It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection. An attacker could use this flaw to cause remote code execution if they are able to provide XSLT content for parsing. Doing a transform in JAXP requires the use of a 'javax.xml.transform.TransformerFactory'. If the FEATURE_SECURE_PROCESSING feature is set to 'true', it mitigates this vulnerability. | Jboss_enterprise_application_platform | 9.8 | |
| 2018-07-27 | CVE-2017-7464 | It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws. An attacker could use this flaw to cause DoS, SSRF, or information disclosure if they are able to provide XML content for parsing. | Jboss_enterprise_application_platform | 9.8 |