CS
Product
Communications Session Route Manager
On CISA KEVExploited in the wild
74
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 48Medium 18Low 2
Watch
Add Communications Session Route Manager to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11023 In wildKEV | 6.1 | Apr 29 | Potential XSS vulnerability in jQuery Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2022-23437 | 6.5 | Jan 24 | Infinite loop within Apache XercesJ xml parser Affected: before 9.0 |
| CVE-2020-13947 | 6.1 | Feb 8 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions… Affected: 8.0.0 through 8.2.2 |
| CVE-2020-1941 | 6.1 | May 14 | In Apache ActiveMQ 5.0.0 to 5.15.11, the webconsole admin GUI is open to XSS, in the view that lists the contents of a queue Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2020-1927 | 6.1 | Apr 2 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-17573 | 6.1 | Jan 16 | By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-11358 | 6.1 | Apr 20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2018-8032 | 6.1 | Aug 2 | Apache Axis 1.x up to and including 1.4 is vulnerable to a cross-site scripting (XSS) attack in the default servlet/services Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2021-45105 | 5.9 | Dec 18 | Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups Affected: before 9.0 |
| CVE-2021-33037 | 5.3 | Jul 12 | Incorrect Transfer-Encoding handling with HTTP/1.0 Affected: 8.0.0 through 8.2.4 |
| CVE-2021-28164 | 5.3 | Apr 1 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources… Affected: 8.0.0 through 8.2.4 |
| CVE-2020-1954 | 5.3 | Apr 1 | Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus Affected: 8.2.0 through 8.2.2 |
| CVE-2020-1934 | 5.3 | Apr 1 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2020-5397 | 5.3 | Jan 17 | Spring Framework, versions 5.2.x prior to 5.2.3 are vulnerable to CSRF attacks through CORS preflight requests that target Spring MVC (spring-webmvc module) or Spring WebFlux… Affected: 8.1.1; 8.2.0; 8.2.1 |
| CVE-2019-10247 | 5.3 | Apr 22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured… Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2019-10246 | 5.3 | Apr 22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a… Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
| CVE-2020-27218 | 4.8 | Nov 28 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests… Affected: 8.0.0 through 8.2.4 |
| CVE-2019-0197 | 4.2 | Jun 11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38 Affected: 8.0.0; 8.1.0; 8.1.1; 8.2.0 |
Showing 18