CS
Product
Communications Session Report Manager
On CISA KEVExploited in the wild
69
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 43Medium 18Low 2
Watch
Add Communications Session Report Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2022-23437 | 6.5 | Jan 24 | Infinite loop within Apache XercesJ xml parser Affected: before 9.0 |
| CVE-2020-5421 | 6.5 | Sep 19 | RFD Protection Bypass via jsessionid Affected: 8.2.1 through 8.2.2.1 |
| CVE-2020-13947 | 6.1 | Feb 8 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions… Affected: 8.0.0 through 8.2.2 |
| CVE-2020-1941 | 6.1 | May 14 | In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2020-1927 | 6.1 | Apr 2 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-17573 | 6.1 | Jan 16 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2018-8032 | 6.1 | Aug 2 | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: before 9.0 |
| CVE-2021-27906 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file Affected: 8.0.0 through 8.2.4.0 |
| CVE-2021-27807 | 5.5 | Mar 19 | A carefully crafted PDF file can trigger an infinite loop while loading the file Affected: 8.0.0 through 8.2.4.0 |
| CVE-2021-33037 | 5.3 | Jul 12 | Incorrect Transfer-Encoding handling with HTTP/1.0 Affected: 8.0.0 through 8.2.4.0 |
| CVE-2020-1954 | 5.3 | Apr 1 | Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus Affected: 8.2.0 through 8.2.2; 8.2.0 through 8.2.2 |
| CVE-2020-1934 | 5.3 | Apr 1 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-10247 | 5.3 | Apr 22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured… Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2019-10246 | 5.3 | Apr 22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a… Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2019-0197 | 4.2 | Jun 11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38 Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2021-34428 | 3.5 | Jun 22 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in… Affected: 8.0.0.0 through 8.2.4.0 |
| CVE-2021-28163 | 2.7 | Apr 1 | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory… Affected: 8.0.0 through 8.2.4.0 |