CS
Product
Communications Session Route Manager
On CISA KEVExploited in the wild
74
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 48Medium 18Low 2
Watch
Add Communications Session Route Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-0227 | 7.5 | May 1 | A Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006 Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2019-5427 | 7.5 | Apr 22 | c3p0 version < 0.9.5.4 may be exploited by a billion laughs attack when loading XML configuration due to missing protections against recursive entity expansion when loading… Affected: 8.2.0 through 8.2.2 |
| CVE-2018-15756 | 7.5 | Oct 18 | DoS Attack via Range Requests Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-10097 | 7.2 | Sep 26 | In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2020-9484 | 7.0 | May 20 | When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a) an attacker is able to control the contents and name of a… Affected: 8.2.0 through 8.2.2 |
| CVE-2022-23437 | 6.5 | Jan 24 | Infinite loop within Apache XercesJ xml parser Affected: before 9.0 |
| CVE-2020-13947 | 6.1 | Feb 8 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions… Affected: 8.0.0 through 8.2.2 |
| CVE-2020-1941 | 6.1 | May 14 | In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2020-1927 | 6.1 | Apr 2 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-17573 | 6.1 | Jan 16 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2018-8032 | 6.1 | Aug 2 | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: before 9.0 |
| CVE-2021-33037 | 5.3 | Jul 12 | Incorrect Transfer-Encoding handling with HTTP/1.0 Affected: 8.0.0 through 8.2.4 |
| CVE-2021-28164 | 5.3 | Apr 1 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources… Affected: 8.0.0 through 8.2.4 |
| CVE-2020-1954 | 5.3 | Apr 1 | Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus Affected: 8.2.0 through 8.2.2 |
| CVE-2020-1934 | 5.3 | Apr 1 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2020-5397 | 5.3 | Jan 17 | Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-10247 | 5.3 | Apr 22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured… Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2019-10246 | 5.3 | Apr 22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a… Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2020-27218 | 4.8 | Nov 28 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests… Affected: 8.0.0 through 8.2.4 |
| CVE-2019-0197 | 4.2 | Jun 11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38 Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2021-34428 | 3.5 | Jun 22 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in… Affected: 8.0.0 through 8.2.4.0 |
| CVE-2021-28163 | 2.7 | Apr 1 | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of the webapps directory… Affected: 8.0.0 through 8.2.4.0 |