Product:

Jboss_enterprise_application_platform

(Redhat)
Repositories • https://github.com/FasterXML/jackson-databind
• https://github.com/qos-ch/slf4j
• https://github.com/bcgit/bc-java
• https://github.com/apache/cxf
• https://github.com/dom4j/dom4j
#Vulnerabilities 223
Date Id Summary Products Score Patch Annotated
2019-06-12 CVE-2019-3873 It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks. Jboss_enterprise_application_platform, Single_sign\-On 9.0
2019-06-12 CVE-2019-3872 It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacker could use this to send a malicious script to achieve cross-site scripting and obtain unauthorized information or conduct further attacks. Jboss_enterprise_application_platform, Single_sign\-On 5.4
2019-03-27 CVE-2018-10934 A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users. Jboss_enterprise_application_platform, Single_sign\-On 5.4
2018-07-27 CVE-2018-10862 WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability. Jboss_enterprise_application_platform, Virtualization, Wildfly_core 5.5
2017-05-18 CVE-2017-7503 It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker could use this flaw to launch DoS or SSRF attacks, or read files from the server where EAP is deployed. Jboss_enterprise_application_platform 9.8
2018-07-26 CVE-2017-2582 It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response. Jboss_enterprise_application_platform, Keycloak 6.5
2017-10-04 CVE-2017-12149 In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of the HTTP Invoker does not restrict classes for which it performs deserialization and thus allowing an attacker to execute arbitrary code via crafted serialized data. Jboss_enterprise_application_platform 9.8
2016-10-13 CVE-2016-7065 The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object. Jboss_enterprise_application_platform 8.8
2016-10-03 CVE-2016-7046 Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and disk consumption) via a long URL. Jboss_enterprise_application_platform 5.9
2017-08-22 CVE-2016-6311 Get requests in JBoss Enterprise Application Platform (EAP) 7 disclose internal IP addresses to remote attackers. Jboss_enterprise_application_platform 5.3