Latest redhat jboss enterprise application platform Vulnerabilities

● CVE-2023-48795
Prefix Truncation Attacks in SSH Specification (Terrapin Attack)
pip/paramiko>=2.5.0<3.4.0
go/golang.org/x/crypto<0.17.0
rust/russh<0.40.2
Apple macOS Sonoma<14.4
redhat/PuTTY<0.80
redhat/AsyncSSH<2.14.1
and 121 more
● CVE-2023-44487
- Rapid Reset HTTP/2 vulnerability
Microsoft Windows 11=21H2
Microsoft Windows 11=21H2
Microsoft Windows Server 2022
Microsoft Windows Server 2022
Microsoft Windows 11=22H2
Microsoft Windows 11=22H2
and 553 more
● CVE-2023-5379
Undertow: ajp request closes connection exceeding maxrequestsize
Redhat Jboss Enterprise Application Platform
Redhat Jboss Enterprise Application Platform=7.0.0
Redhat Single Sign-on=7.0
Redhat Undertow
● CVE-2023-4061
Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor
redhat/wildfly-core<15.0.30.
Redhat Jboss Enterprise Application Platform
Redhat Wildfly Core<15.0.30
Redhat Jboss Enterprise Application Platform=7.4
Redhat Enterprise Linux=7.0
Redhat Enterprise Linux=8.0
and 2 more
● CVE-2023-3629
Infinispan: non-admins should not be able to get cache config via rest api
<8.4.4
=6
● CVE-2023-3628
Infispan: rest bulk ops don't check permissions
=6
<8.4.4
● CVE-2023-3171
Heap exhaustion via deserialization
=7.4
=7.0
=8.0
=9.0
● CVE-2023-3223
Outofmemoryerror due to @multipartconfig handling
redhat/undertow<2.2.24
Redhat Undertow<2.2.24
Redhat Openshift Container Platform=4.11
Redhat Openshift Container Platform=4.12
Redhat Openshift Container Platform For Ibm Linuxone=4.9
Redhat Openshift Container Platform For Ibm Linuxone=4.10
and 10 more
● CVE-2023-4503
Eap-galleon: custom provisioning creates unsecured http-invoker
Redhat Jboss Enterprise Application Platform
Redhat Jboss Enterprise Application Platform Expansion Pack
Redhat Jboss Enterprise Application Platform=7.4
Redhat Enterprise Linux=7.0
Redhat Enterprise Linux=8.0
Redhat Enterprise Linux=9.0
● CVE-2023-1108
Infinite loop in sslconduit during close
redhat/eap7-undertow<0:2.2.22-1.SP3_redhat_00002.1.el8ea
redhat/eap7-wildfly<0:7.4.9-6.GA_redhat_00004.1.el8ea
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.22-1.SP3_redhat_00002.1.el9ea
redhat/eap7-wildfly<0:7.4.9-6.GA_redhat_00004.1.el9ea
and 39 more
● CVE-2022-4492
Undertow could provide weaker than expected security, caused by not checking the server identity the server certificate presents in HTTPS connections. An attacker could exploit this vulnerability to l...
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el9ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el9ea
redhat/eap7-undertow<0:2.2.23-1.SP2_redhat_00001.1.el7ea
redhat/eap7-undertow-jastow<0:2.0.14-1.Final_redhat_00001.1.el7ea
and 14 more
● CVE-2022-3143
wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerab...
redhat/wildfly-elytron<1.15.15
redhat/wildfly-elytron<1.20.3
redhat/eap7-wildfly-elytron<0:1.15.16-1.Final_redhat_00001.1.el8ea
redhat/eap7-wildfly-elytron<0:1.15.16-1.Final_redhat_00001.1.el9ea
redhat/eap7-wildfly-elytron<0:1.15.16-1.Final_redhat_00001.1.el7ea
Redhat Wildfly Elytron=1.15.15
and 1 more
● CVE-2022-2764
A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.
redhat/eap7-undertow<0:2.2.20-1.SP1_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.20-1.SP1_redhat_00001.1.el9ea
redhat/eap7-undertow<0:2.2.20-1.SP1_redhat_00001.1.el7ea
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el8
redhat/rh-sso7-keycloak<0:18.0.6-1.redhat_00001.1.el9
and 13 more
● CVE-2022-1259
Undertow is vulnerable to a denial of service, caused by a potential security issue in flow control over HTTP/2. By sending a specially-crafted packet, a remote attacker could exploit this vulnerabili...
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el9ea
redhat/eap7-undertow<0:2.2.19-1.SP2_redhat_00001.1.el7ea
Redhat Build Of Quarkus
Redhat Integration Camel K
Redhat Jboss Enterprise Application Platform=7.0.0
and 12 more
● CVE-2022-0866
This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.e...
redhat/eap7-wildfly<0:7.4.5-3.GA_redhat_00001.1.el8ea
redhat/eap7-wildfly<0:7.4.5-3.GA_redhat_00001.1.el7ea
redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:15.0.8-1.redhat_00001.1.el8
redhat/rh-sso7-keycloak<0:18.0.3-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:18.0.3-1.redhat_00001.1.el8
and 6 more
● CVE-2022-0853
A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.
redhat/eap7-wildfly-http-client<0:1.1.11-1.SP1_redhat_00001.1.el8ea
redhat/eap7-wildfly-http-client<0:1.1.11-1.SP1_redhat_00001.1.el7ea
redhat/rh-sso7-keycloak<0:18.0.3-1.redhat_00001.1.el7
redhat/rh-sso7-keycloak<0:18.0.3-1.redhat_00001.1.el8
redhat/rh-sso7<0:1-5.el9
redhat/rh-sso7-javapackages-tools<0:6.0.0-7.el9
and 6 more
● CVE-2021-4104
Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
redhat/log4j<0:1.2.14-6.5.el6_10
redhat/log4j<0:1.2.17-17.el7_4
redhat/log4j<0:1.2.17-16.el7_3
redhat/log4j-eap6<0:1.2.17-3.redhat_00008.1.ep6.el6
redhat/log4j-jboss-logmanager<0:1.1.4-3.Final_redhat_00002.1.ep6.el6
redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6
and 219 more
● CVE-2021-20318
The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using ...
redhat/eap7-hornetq<0:2.4.8-1.Final_redhat_00001.1.el8ea
redhat/eap7-hornetq<0:2.4.8-1.Final_redhat_00001.1.el7ea
Redhat Jboss Enterprise Application Platform=7.3.9-general_availability
Redhat Jboss Enterprise Application Platform=7.4.0-general_availability
● CVE-2021-3859
A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.
redhat/eap7-undertow<0:2.0.41-2.SP2_redhat_00001.1.el6ea
redhat/eap7-undertow<0:2.0.41-2.SP2_redhat_00001.1.el7ea
redhat/eap7-undertow<0:2.0.41-2.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.13-1.SP2_redhat_00001.1.el8ea
redhat/eap7-undertow<0:2.2.13-1.SP2_redhat_00001.1.el7ea
redhat/rh-sso7-keycloak<0:15.0.4-1.redhat_00003.1.el7
and 10 more
● CVE-2021-3717
A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat f...
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea
and 40 more
● CVE-2021-3690
A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from thi...
redhat/eap7-undertow<0:2.0.38-2.SP2_redhat_00001.1.el6ea
redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea
and 56 more
● CVE-2021-3642
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest th...
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea
and 47 more
● CVE-2021-3597
A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availabili...
redhat/eap7-apache-commons-io<0:2.10.0-1.redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.16-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-4.SP2_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.35-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-2.redhat_00006.1.el6ea
redhat/eap7-jberet<0:1.3.9-1.Final_redhat_00001.1.el6ea
and 60 more
● CVE-2021-32029
PostgreSQL could allow a remote authenticated attacker to obtain sensitive information, caused by an error when using an UPDATE…RETURNING command on a purpose-crafted table. An attacker could exploit ...
IBM Security Verify Access<=10.0.0
redhat/postgresql<13.3
redhat/postgresql<12.7
redhat/postgresql<11.12
PostgreSQL PostgreSQL>=11.0<11.12
PostgreSQL PostgreSQL>=12.0<12.7
and 2 more
● CVE-2021-32027
PostgreSQL could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an integer overflow while modifying certain SQL array values. By sending a specially-crafted r...
IBM Security Verify Access<=10.0.0
redhat/postgresql<13.3
redhat/postgresql<12.7
redhat/postgresql<11.12
redhat/postgresql<10.17
redhat/postgresql<9.6.22
and 9 more
● CVE-2021-3536
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affe...
redhat/Wildfly<23.0.2.
redhat/eap7-elytron-web<0:1.6.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.15-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-3.SP1_redhat_00001.1.el6ea
redhat/eap7-infinispan<0:9.4.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.4.33-1.Final_redhat_00001.1.el6ea
and 45 more
● CVE-2021-3629
A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat fro...
redhat/eap7-apache-cxf<0:3.3.12-1.redhat_00001.1.el6ea
redhat/eap7-ironjacamar<0:1.5.3-1.Final_redhat_00001.1.el6ea
redhat/eap7-jakarta-el<0:3.0.3-3.redhat_00007.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.43-1.Final_redhat_00001.1.el6ea
redhat/eap7-jboss-server-migration<0:1.7.2-10.Final_redhat_00011.1.el6ea
redhat/eap7-jsoup<0:1.14.2-1.redhat_00002.1.el6ea
and 48 more
● CVE-2020-25710
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest thr...
Openldap Openldap<2.4.56
Microsoft .NET 7.0
Redhat Jboss Enterprise Application Platform=5.0.0
Redhat Jboss Enterprise Web Server=2.0.0
Redhat Enterprise Linux=5.0
Redhat Enterprise Linux=6.0
and 5 more
● CVE-2020-25689
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able ...
redhat/eap7-activemq-artemis<0:2.9.0-7.redhat_00017.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.9-12.SP13_redhat_00001.1.el6ea
redhat/eap7-hal-console<0:3.2.12-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.20-1.Final_redhat_00001.1.el6ea
redhat/eap7-httpcomponents-client<0:4.5.13-1.redhat_00001.1.el6ea
redhat/eap7-jboss-ejb-client<0:4.0.37-1.Final_redhat_00001.1.el6ea
and 63 more
● CVE-2020-25644
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session. It may allow the attacker to cause OOM leading to a denial of service. The highest t...
maven/org.wildfly.openssl:wildfly-openssl-natives-parent<1.1.3.Final
redhat/eap7-activemq-artemis<0:2.9.0-6.redhat_00016.1.el6ea
redhat/eap7-fge-btf<0:1.2.0-1.redhat_00007.1.el6ea
redhat/eap7-fge-msg-simple<0:1.1.0-1.redhat_00007.1.el6ea
redhat/eap7-hal-console<0:3.2.11-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator<0:6.0.21-1.Final_redhat_00001.1.el6ea
and 67 more
● CVE-2020-14384
A flaw was found in JBossWeb in versions before 7.5.31.Final-redhat-3. The fix for CVE-2020-13935 was incomplete in JBossWeb, leaving it vulnerable to a denial of service attack when sending multiple ...
redhat/jbossweb<0:7.5.31-3.Final_redhat_3.1.ep6.el5
redhat/jbossweb<0:7.5.31-3.Final_redhat_3.1.ep6.el6
redhat/jboss-as-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6
redhat/jbossas-appclient<0:7.5.24-2.Final_redhat_00001.1.ep6.el6
redhat/jbossas-bundles<0:7.5.24-2.Final_redhat_00001.1.ep6.el6
redhat/jboss-as-cli<0:7.5.24-2.Final_redhat_00001.1.ep6.el6
and 129 more
● CVE-2020-14340
A flaw was found in xnio. A file descriptor leak caused by growing amounts of NIO Selector file, handled between garbage collection cycles, may allow the attacker to cause a denial of service. The hig...
redhat/eap7-activemq-artemis<0:2.9.0-5.redhat_00011.1.el6ea
redhat/eap7-activemq-artemis-native<1:1.0.2-1.redhat_00001.1.el6ea
redhat/eap7-apache-commons-codec<0:1.14.0-1.redhat_00001.1.el6ea
redhat/eap7-apache-commons-lang<0:3.10.0-1.redhat_00001.1.el6ea
redhat/eap7-apache-cxf<0:3.3.7-1.redhat_00001.1.el6ea
redhat/eap7-artemis-native<1:1.0.2-3.redhat_1.el6ea
and 102 more
● CVE-2020-14317
It was found that the issue for security flaw <a href="https://access.redhat.com/security/cve/CVE-2019-3805">CVE-2019-3805</a> appeared again in a further version of JBoss Enterprise Application Platf...
Redhat Jboss Enterprise Application Platform
Redhat Wildfly
● CVE-2020-14299
A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode. Th...
redhat/eap7-activemq-artemis<0:2.9.0-5.redhat_00011.1.el6ea
redhat/eap7-activemq-artemis-native<1:1.0.2-1.redhat_00001.1.el6ea
redhat/eap7-apache-commons-codec<0:1.14.0-1.redhat_00001.1.el6ea
redhat/eap7-apache-commons-lang<0:3.10.0-1.redhat_00001.1.el6ea
redhat/eap7-apache-cxf<0:3.3.7-1.redhat_00001.1.el6ea
redhat/eap7-artemis-native<1:1.0.2-3.redhat_1.el6ea
and 81 more
● CVE-2020-10719
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request sm...
redhat/Undertow<2.1.1.
redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea
redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea
redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea
redhat/eap7-cryptacular<0:1.2.4-1.redhat_00001.1.el6ea
and 278 more
● CVE-2020-10693
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attacke...
redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea
redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea
redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea
and 394 more
● CVE-2020-10688
A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. ...
redhat/resteasy<3.11.1.
redhat/resteasy<4.5.3.
redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea
redhat/eap7-apache-cxf<0:3.3.5-1.redhat_00001.1.el6ea
redhat/eap7-bouncycastle<0:1.60.0-2.redhat_00002.1.el6ea
redhat/eap7-codehaus-jackson<0:1.9.13-10.redhat_00007.1.el6ea
and 174 more
● CVE-2020-10705
A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead t...
Redhat Undertow<2.1.1
NetApp OnCommand Insight
Redhat Jboss Enterprise Application Platform
Redhat Openshift Application Runtimes
Redhat Jboss Enterprise Application Platform=7.2
Redhat Enterprise Linux=8.0
and 269 more
● CVE-2020-1732
A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elyt...
Redhat Soteria<1.0.1
Redhat Jboss Enterprise Application Platform=7.0.0
Redhat Jboss Enterprise Application Platform Continuous Delivery
Redhat Openshift Application Runtimes
redhat/eap7-activemq-artemis<0:2.9.0-4.redhat_00010.1.el6ea
redhat/eap7-apache-cxf<0:3.2.12-1.redhat_00001.1.el6ea
and 136 more
● CVE-2019-20444
HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid...
maven/io.netty:netty<4.0.0
maven/org.jboss.netty:netty<4.0.0
maven/io.netty:netty-codec-http>=4.0.0<4.1.44
redhat/qpid-proton<0:0.30.0-4.el6_10
redhat/qpid-proton<0:0.30.0-2.el7
redhat/nodejs-rhea<0:1.0.16-1.el8
and 100 more
● CVE-2019-20445
HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.
maven/io.netty:netty<4.0.0
maven/org.jboss.netty:netty<4.0.0
maven/io.netty:netty-handler>=4.0.0<4.1.45
redhat/qpid-proton<0:0.30.0-4.el6_10
redhat/qpid-proton<0:0.30.0-2.el7
redhat/nodejs-rhea<0:1.0.16-1.el8
and 102 more
● CVE-2020-7238
Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exis...
redhat/qpid-proton<0:0.30.0-4.el6_10
redhat/qpid-proton<0:0.30.0-2.el7
redhat/nodejs-rhea<0:1.0.16-1.el8
redhat/qpid-proton<0:0.30.0-3.el8
redhat/eap7-netty<0:4.1.45-1.Final_redhat_00001.1.el6ea
redhat/eap7-activemq-artemis<0:2.9.0-2.redhat_00009.1.el6ea
and 366 more
● CVE-2012-5626
EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in ...
Redhat Jboss Brms=5
Redhat Jboss Enterprise Application Platform=5.0.0
Redhat Jboss Enterprise Web Server=1.0.0
Redhat Jboss Operations Network=3.1
Redhat Jboss Portal=4.0.0
Redhat Jboss Portal=5.0.0
and 3 more
● CVE-2020-1710
The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
redhat/eap7-dom4j<0:2.1.3-1.redhat_00001.1.el6ea
redhat/eap7-elytron-web<0:1.2.5-1.Final_redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-13.SP3_redhat_00011.1.el6ea
redhat/eap7-hal-console<0:3.0.23-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.17-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator<0:6.0.20-1.Final_redhat_00001.1.el6ea
and 111 more
● CVE-2014-0169
In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an authenticated user in one application to acce...
Redhat Jboss Enterprise Application Platform=6.0.0
● CVE-2020-10687
A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid c...
Redhat Undertow<2.2.0
Redhat Jboss Enterprise Application Platform
Redhat Single Sign-on
Redhat Jboss Enterprise Application Platform=7.2
Redhat Enterprise Linux=6.0
Redhat Enterprise Linux=7.0
and 159 more
● CVE-2012-2312
An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains...
Redhat Jboss Application Server=7.1.0
Redhat Jboss Application Server=7.1.1
Redhat Jboss Enterprise Application Platform=6.0.0-beta
debian/jbossas4
● CVE-2013-6495
JBossWeb Bayeux has reflected XSS
Redhat Jboss Enterprise Application Platform>=6.0.0<6.1.1
Redhat Jboss Portal>=6.0.0<6.1.0
● CVE-2019-19343
A flaw was found in Undertow as shipped in Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. References: ...
redhat/undertow<2.0.25.
redhat/jboss-remoting<5.0.14.
Redhat Jboss-remoting<5.0.14
Redhat Jboss-remoting=5.0.14
Redhat Jboss Enterprise Application Platform<7.2.4
Redhat Undertow<2.0.25
and 4 more
● CVE-2019-14888
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the se...
redhat/eap7-apache-cxf<0:3.2.11-1.redhat_00001.1.el6ea
redhat/eap7-glassfish-jsf<0:2.3.5-6.SP3_redhat_00004.1.el6ea
redhat/eap7-hal-console<0:3.0.19-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate<0:5.3.14-1.Final_redhat_00001.1.el6ea
redhat/eap7-hibernate-validator<0:6.0.18-1.Final_redhat_00001.1.el6ea
redhat/eap7-jackson-annotations<0:2.9.10-1.redhat_00003.1.el6ea
and 79 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203