JE
Product
Jboss Enterprise Application Platform
On CISA KEVExploited in the wildRansomware-linked
241
CVEs
5
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 36High 76Medium 60Low 1
Watch
Add Jboss Enterprise Application Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-12149 RansomwareIn wildKEV | 9.8 | Oct 4 | Red Hat JBoss Application Server Remote Code Execution Vulnerability Affected: 5.0.0; 5.0.1; 5.1.0; 5.1.1; 5.1.2; 5.2.0; +2 more |
| CVE-2010-1871 In wildKEV | 8.8 | Aug 4 | Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability Affected: 4.3.0 |
| CVE-2017-12617 In wildKEV | 8.1 | Oct 3 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 6.0.0; 6.4.0 |
| CVE-2010-1428 RansomwareIn wildKEV | 7.5 | Apr 28 | Red Hat JBoss Information Disclosure Vulnerability Affected: 4.2.0; 4.3.0 |
| CVE-2010-0738 RansomwareIn wildKEV | 5.3 | Apr 28 | Red Hat JBoss Authentication Bypass Vulnerability Affected: 4.2.0; 4.3.0 |
| CVE-2018-14721 | 10.0 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class… Affected: 7.2.0 |
| CVE-2019-14892 | 9.8 | Mar 2 | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using… Affected: 7.0 |
| CVE-2019-17531 | 9.8 | Oct 12 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 7.2; 7.3 |
| CVE-2019-17267 | 9.8 | Oct 6 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 7.2; 7.3 |
| CVE-2019-10212 | 9.8 | Oct 2 | A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security Affected: 7.2; 7.3; 7.4; 7.2; 7.3; 7.4; +2 more |
| CVE-2019-16943 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 7.2; 7.3; 7.2; 7.3 |
| CVE-2019-16942 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 7.2.0; 7.3 |
| CVE-2019-10202 | 9.8 | Oct 1 | A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7 Affected: 7.2.0 |
| CVE-2019-16335 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 7.2; 7.3 |
| CVE-2019-14540 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 7.2; 7.3 |
| CVE-2019-14379 | 9.8 | Jul 29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 7.2; 7.3; 7.2; 7.3; 7.2; 7.3 |
| CVE-2018-14720 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from… Affected: 7.2.0 |
| CVE-2017-7464 | 9.8 | Jul 27 | It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws Affected: 7.0 |
| CVE-2017-7465 | 9.8 | Jun 27 | It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection Affected: 7.0.0 |
| CVE-2018-8088 | 9.8 | Mar 20 | org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data Affected: 7.1; 6.0.0; 6.4.0 |
| CVE-2018-7489 | 9.8 | Feb 26 | FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the… Affected: 6.4.19; 7.1.2 |
| CVE-2017-7525 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: 6.0.0; 6.4.0; 7.0; 7.1; 6.0.0; 6.4.0 |
| CVE-2017-15095 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: 6.0.0; 6.4.0; 7.1.0 |
| CVE-2017-17485 | 9.8 | Jan 10 | FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization… Affected: 6.0.0; 6.4.0; 7.1; 6.0.0; 6.4.0 |
| CVE-2015-7501 | 9.8 | Nov 9 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;… Affected: 4.3.0; 5.0.0; 6.0.0 |
| CVE-2017-12629 | 9.8 | Oct 14 | Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the… Affected: 7.0.0; 7.1.0 |
| CVE-2016-3690 | 9.8 | Jun 8 | The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload Affected: 4.2.0; 4.3.0; 5.0.0; 5.1.0; 5.1.1; 5.1.2; +1 more |
| CVE-2017-7504 | 9.8 | May 19 | HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not… Affected: through 4.0 |
| CVE-2017-7503 | 9.8 | May 18 | It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE Affected: 7.0.5 |
| CVE-2016-2141 | 9.8 | Jun 30 | It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster Affected: 5.2; 6.4; 7.0 |
| CVE-2025-12543 | 9.6 | Jan 7 | Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Affected: 8.0 before 8.0.12; 8.1.0 before 8.1.3; 7.0.0 |
| CVE-2026-28369 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via malformed http request headers Affected: 7.0.0; 8.0.0 |
| CVE-2026-28367 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Affected: 7.0.0; 8.0.0 |
| CVE-2026-28368 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via inconsistent header parsing Affected: 7.0.0; 8.0.0 |
| CVE-2019-14887 | 9.1 | Mar 16 | A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored Affected: 7.0.0 |
| CVE-2019-20444 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be… Affected: 7.2; 7.3 |
| CVE-2019-20445 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header Affected: 7.2; 7.3 |
| CVE-2016-5018 | 9.1 | Aug 10 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured… Affected: 6.4 |
| CVE-2017-9788 | 9.1 | Jul 13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between… Affected: 6.0.0; 6.4.0 |
| CVE-2019-3873 | 9.0 | Jun 12 | It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML Affected: 7.2.0 |
| CVE-2021-32027 | 8.8 | Jun 1 | A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22 Affected: 7.0.0 |
| CVE-2019-14843 | 8.8 | Jan 7 | A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester Affected: 7.2.0; 7.2.0 |
| CVE-2019-10174 | 8.8 | Nov 25 | A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any… Affected: 7.2 |
| CVE-2019-3894 | 8.8 | May 3 | It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as Affected: 7.0.0 |
| CVE-2016-7065 | 8.8 | Oct 13 | The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code… Affected: 4.0.0; 5.0.0 |
| CVE-2016-5406 | 8.8 | Sep 26 | The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain privileges by leveraging failure to… Affected: through 7.0.1 |
| CVE-2026-3009 | 8.1 | Mar 5 | A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by… Affected: 8.0 |
| CVE-2025-23368 | 8.1 | Mar 4 | Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli Affected: 7.0.0; 8.0.0 |
| CVE-2020-1757 | 8.1 | Apr 21 | A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet… Affected: 7.0.0 |
| CVE-2018-8039 | 8.1 | Jul 2 | It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");' Affected: 7.1.0 |