JE
Product
Jboss Enterprise Application Platform
On CISA KEVExploited in the wildRansomware-linked
241
CVEs
5
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 36High 76Medium 60Low 1
Watch
Add Jboss Enterprise Application Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-12400 | 5.5 | Aug 23 | In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders Affected: 7.2 |
| CVE-2018-10862 | 5.5 | Jul 27 | WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files Affected: 7.1.0; 7.1.0 |
| CVE-2017-12167 | 5.5 | Jul 26 | It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are world readable… Affected: before 7.0.9; 7.1.0; 7.0.0 |
| CVE-2018-1047 | 5.5 | Jan 24 | A flaw was found in Wildfly 9.x Affected: 7.1.0 |
| CVE-2019-3872 | 5.4 | Jun 12 | It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x Affected: 7.2.0 |
| CVE-2018-10934 | 5.4 | Mar 27 | A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA Affected: 7.0; 7.1.0 |
| CVE-2022-0866 | 5.3 | May 10 | This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal Affected: 7.1.0 and later |
| CVE-2021-3642 | 5.3 | Aug 5 | A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if… Affected: 7.0.0 |
| CVE-2020-1710 | 5.3 | Sep 16 | The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400 Affected: 6.4.21; 7.0.0; 7.2.0; 7.3.0 |
| CVE-2020-10693 | 5.3 | May 6 | A flaw was found in Hibernate Validator version 6.1.2.Final Affected: 7.2.0; 7.3.0 |
| CVE-2018-14642 | 5.3 | Sep 18 | An information leak vulnerability was found in Undertow Affected: 7.1; 7.2; 7.3 |
| CVE-2016-9585 | 5.3 | Mar 9 | Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it Affected: 5.0.0 |
| CVE-2016-6311 | 5.3 | Aug 22 | Get requests in JBoss Enterprise Application Platform (EAP) 7 disclose internal IP addresses to remote attackers Affected: 7.0 |
| CVE-2012-4550 | 5.3 | Jan 5 | A flaw was found in JBoss Enterprise Application Platform Affected: 6.0.0 |
| CVE-2022-2764 | 4.9 | Sep 1 | A flaw was found in Undertow Affected: 7.0.0 |
| CVE-2019-14838 | 4.9 | Oct 14 | A flaw was found in wildfly-core before 7.2.5.GA Affected: 7.2.0; 7.2.5; 7.3.0; 7.2.4 |
| CVE-2021-3536 | 4.8 | May 20 | A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field,… Affected: 7.0 |
| CVE-2020-10687 | 4.8 | Sep 23 | A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to… Affected: 7.2; 7.3; 7.4; 7.3 |
| CVE-2019-3805 | 4.7 | May 3 | A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system Affected: 6.0.0; 7.0.0 |
| CVE-2019-14885 | 4.3 | Jan 23 | A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA Affected: before 7.2.6; 7.2.6 |
| CVE-2019-14820 | 4.3 | Jan 8 | It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL Affected: 6.4.0; 7.2.0 |
| CVE-2020-1732 | 4.2 | May 4 | A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE… Affected: 7.0.0 |
| CVE-2026-4874 | 3.1 | Mar 26 | Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation Affected: 8.0.0 |
| CVE-2015-5304 | – | Dec 16 | Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the… Affected: through 6.4.4 |
| CVE-2015-5220 | – | Oct 27 | The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service… Affected: through 6.4.3 |
| CVE-2015-5188 | – | Oct 27 | Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application… Affected: through 6.4.3 |
| CVE-2015-5178 | – | Oct 27 | The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which… Affected: through 6.4.3 |
| CVE-2014-3586 | – | Apr 21 | The default configuration for the Command Line Interface in Red Hat Enterprise Application Platform before 6.4.0 and WildFly (formerly JBoss Application Server) uses weak… Affected: through 6.3.3 |
| CVE-2014-0005 | – | Feb 20 | PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to… Affected: 6.2.2 |
| CVE-2014-7853 | – | Feb 13 | The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properly assign socket-binding-ref sensitivity… Affected: through 6.3.2 |
| CVE-2014-7849 | – | Feb 13 | The Role Based Access Control (RBAC) implementation in JBoss Enterprise Application Platform (EAP) 6.2.0 through 6.3.2 does not properly verify authorization conditions, which… Affected: 6.2.0; 6.2.1; 6.2.2; 6.2.3; 6.2.4; 6.3.0; +2 more |
| CVE-2014-7827 | – | Feb 13 | The org.jboss.security.plugins.mapping.JBossMappingManager implementation in JBoss Security in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 uses the default… Affected: through 6.3.2 |
| CVE-2014-0059 | – | Nov 17 | JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform (EAP) before 6.2.3, use world-readable permissions on audit.log, which allows local users to… Affected: through 6.2.2 |
| CVE-2014-3490 | – | Aug 19 | RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the… Affected: 6.3.0 |
| CVE-2014-3472 | – | Aug 19 | The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly… Affected: 6.3.0 |
| CVE-2014-3464 | – | Aug 19 | The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level… Affected: 6.2.0; 6.3.0 |
| CVE-2014-3530 | – | Jul 22 | The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 5.2.0 and 6.2.4,… Affected: 5.2.0; 6.2.4 |
| CVE-2014-3518 | – | Jul 22 | jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red… Affected: 5.2.0 |
| CVE-2014-0226 | – | Jul 20 | Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denial of service (heap-based buffer overflow), or possibly… Affected: 6.0.0; 6.4.0 |
| CVE-2014-0118 | – | Jul 20 | The deflate_in_filter function in mod_deflate.c in the mod_deflate module in the Apache HTTP Server before 2.4.10, when request body decompression is enabled, allows remote… Affected: 6.0.0; 6.4.0 |
| CVE-2014-3481 | – | Jul 7 | org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote… Affected: through 6.2.3; 6.0.0; 6.0.1; 6.1.0; 6.2.0; 6.2.1; +1 more |
| CVE-2014-0248 | – | Jul 7 | org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP)… Affected: 5.2.0 |
| CVE-2014-0035 | – | Jul 7 | The SymmetricBinding in Apache CXF before 2.6.13 and 2.7.x before 2.7.10, when EncryptBeforeSigning is enabled and the UsernameToken policy is set to an EncryptedSupportingToken,… Affected: 6.0.0; 6.2.0 |
| CVE-2014-0034 | – | Jul 7 | The SecurityTokenService (STS) in Apache CXF before 2.6.12 and 2.7.x before 2.7.9 does not properly validate SAML tokens when caching is enabled, which allows remote attackers to… Affected: 6.0.0; 6.2.0 |
| CVE-2014-0093 | – | Apr 3 | Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2, when using a Java Security Manager (JSM), does not properly apply permissions defined by a policy file, which causes… Affected: 6.2.2 |
| CVE-2014-0058 | – | Feb 26 | The security audit functionality in Red Hat JBoss Enterprise Application Platform (EAP) 6.x before 6.2.1 logs request parameters in plaintext, which might allow local users to… Affected: 6.0.0; 6.0.1; 6.1.0; 6.2.0 |
| CVE-2014-0018 | – | Feb 14 | Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular… Affected: 6.2.0 |
| CVE-2011-4610 | – | Feb 10 | JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products,… Affected: through 5.1.2 |
| CVE-2012-3427 | – | Feb 2 | EC2 Amazon Machine Image (AMI) in JBoss Enterprise Application Platform (EAP) 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive… Affected: 5.1.2 |
| CVE-2013-2185 | – | Jan 19 | The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0,… Affected: 6.1.0 |