JE
Product
Jboss Enterprise Application Platform
On CISA KEVExploited in the wildRansomware-linked
241
CVEs
5
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 36High 76Medium 60Low 1
Watch
Add Jboss Enterprise Application Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-8610 | 7.5 | Nov 13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection… Affected: 6.0.0; 6.4.0 |
| CVE-2017-7561 | 7.5 | Sep 13 | Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact Affected: 3.0.7; 3.0.8; 3.1.0; 3.1.1; 3.1.2; 3.1.4; +8 more |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 6.4 |
| CVE-2016-3110 | 7.5 | Sep 26 | mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of =… Affected: 6.0.0; 6.4.0 |
| CVE-2016-2183 | 7.5 | Sep 1 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which… Affected: 6.0.0 |
| CVE-2022-3143 | 7.4 | Jan 13 | wildfly-elytron: possible timing attacks via use of unsafe comparator Affected: 7.0.0 |
| CVE-2014-0224 | 7.4 | Jun 5 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers… Affected: 5.2.0; 6.2.3 |
| CVE-2024-10234 | 7.3 | Oct 22 | A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system Affected: 8.0 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 7.2.0 |
| CVE-2026-3121 | 7.2 | Mar 26 | Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission Affected: 8.0.0 |
| CVE-2021-20318 | 7.2 | Dec 23 | The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978 Affected: 7.3.9; 7.4.0 |
| CVE-2016-4978 | 7.2 | Sep 27 | The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0… Affected: 6.0.0; 6.4.0; 7.0.0; 7.1.0 |
| CVE-2017-7536 | 7.0 | Jan 10 | In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private… Affected: 6.0.0; 6.4.0; 7.0; 7.1 |
| CVE-2025-23367 | 6.5 | Jan 30 | A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider Affected: 7.4 before 7.4.21; 8.0.0 before 8.0.7 |
| CVE-2024-1102 | 6.5 | Apr 25 | Jberet: jberet-core logging database credentials Affected: 8.0 |
| CVE-2023-3629 | 6.5 | Dec 18 | A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation Affected: 6 |
| CVE-2023-3628 | 6.5 | Dec 18 | A flaw was found in Infinispan's REST Affected: 6 |
| CVE-2023-4061 | 6.5 | Nov 8 | A flaw was found in wildfly-core Affected: 7.4 |
| CVE-2021-32029 | 6.5 | Oct 8 | A flaw was found in postgresql Affected: 7.0.0 |
| CVE-2020-25689 | 6.5 | Nov 2 | A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly… Affected: 7.0.0 |
| CVE-2020-14299 | 6.5 | Oct 16 | A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded… Affected: before 5.0.3 |
| CVE-2019-14900 | 6.5 | Jul 6 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1 Affected: 7.3; 7.4; 7.3; 7.4; 7.3; 7.2; +2 more |
| CVE-2020-10719 | 6.5 | May 26 | A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes Affected: 7.3; 7.4; 7.3; 7.4; 7.3; 7.2; +2 more |
| CVE-2014-0169 | 6.5 | Jan 2 | In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain Affected: 6.0.0 |
| CVE-2019-9516 | 6.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service Affected: 7.2.0; 7.3.0 |
| CVE-2016-7061 | 6.5 | Sep 10 | An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4 Affected: before 7.0.4 |
| CVE-2017-2595 | 6.5 | Jul 27 | It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal Affected: 6.0.0; 6.4.0; 7.0.0; 7.1.0 |
| CVE-2017-2666 | 6.5 | Jul 27 | It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters Affected: 7.0.0; 7.1.0; 7.0.0; 7.1.0 |
| CVE-2017-2582 | 6.5 | Jul 26 | It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property Affected: 6.0.0; 6.4.0; 7.0.0; 7.1.0 |
| CVE-2016-8627 | 6.5 | May 11 | admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them… Affected: 6.4.0; 7.0.0; 7.1.0 |
| CVE-2012-4549 | 6.5 | Jan 5 | A flaw was found in JBoss Enterprise Application Platform Affected: through 6.0.0; 4.2.0; 4.3.0; 5.0.0; 5.0.1; 5.1.0; +5 more |
| CVE-2023-1932 | 6.1 | Nov 7 | A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by… Affected: 7.0.0 |
| CVE-2020-10688 | 6.1 | May 27 | A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the… Affected: 7.3; 7.4 |
| CVE-2013-6495 | 6.1 | Dec 11 | JBossWeb Bayeux has reflected XSS Affected: 6.0.0 before 6.1.1 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 7.2; 7.3 |
| CVE-2018-1067 | 6.1 | May 21 | In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP… Affected: 7.1 |
| CVE-2016-4993 | 6.1 | Sep 26 | CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers… Affected: through 7.0.1 |
| CVE-2023-48795 | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: 7.0 |
| CVE-2021-3629 | 5.9 | May 24 | A flaw was found in Undertow Affected: 7.4; 7.3 |
| CVE-2021-3597 | 5.9 | May 24 | A flaw was found in undertow Affected: 7.3; 7.4 |
| CVE-2020-14340 | 5.9 | Jun 2 | A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles Affected: 5.0.0; 6.0.0 |
| CVE-2011-2487 | 5.9 | Mar 11 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack Affected: 5.0.0 |
| CVE-2018-10237 | 5.9 | Apr 26 | Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this… Affected: 6.0.0; 6.4.0; 7.1.0; 6.0.0; 6.4.0; 6.0.0; +2 more |
| CVE-2017-12196 | 5.9 | Apr 18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the… Affected: 7.0.0 |
| CVE-2018-1304 | 5.9 | Feb 28 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49… Affected: 6; 6.4 |
| CVE-2015-1849 | 5.9 | Sep 19 | AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP… Affected: through 6.4.0 |
| CVE-2016-7046 | 5.9 | Oct 3 | Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and… Affected: 7.0 |
| CVE-2026-4366 | 5.8 | Mar 18 | Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak Affected: 8.0.0 |
| CVE-2025-5731 | 5.5 | Jun 26 | A flaw was found in Infinispan CLI Affected: 7.0.0; 8.0.0 |
| CVE-2020-14317 | 5.5 | Jun 2 | It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - Continuous Delivery (EAP-CD) introducing… Affected: All versions, or not specified |