JE
Product
Jboss Enterprise Application Platform
On CISA KEVExploited in the wildRansomware-linked
241
CVEs
5
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 36High 76Medium 60Low 1
Watch
Add Jboss Enterprise Application Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-12149 RansomwareIn wildKEV | 9.8 | Oct 4 | Red Hat JBoss Application Server Remote Code Execution Vulnerability Affected: 5.0.0; 5.0.1; 5.1.0; 5.1.1; 5.1.2; 5.2.0; +2 more |
| CVE-2018-14721 | 10.0 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class… Affected: 7.2.0 |
| CVE-2019-14892 | 9.8 | Mar 2 | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using… Affected: 7.0 |
| CVE-2019-17531 | 9.8 | Oct 12 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 7.2; 7.3 |
| CVE-2019-17267 | 9.8 | Oct 6 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 7.2; 7.3 |
| CVE-2019-10212 | 9.8 | Oct 2 | A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security Affected: 7.2; 7.3; 7.4; 7.2; 7.3; 7.4; +2 more |
| CVE-2019-16943 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 7.2; 7.3; 7.2; 7.3 |
| CVE-2019-16942 | 9.8 | Oct 1 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10 Affected: 7.2.0; 7.3 |
| CVE-2019-10202 | 9.8 | Oct 1 | A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7 Affected: 7.2.0 |
| CVE-2019-16335 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 7.2; 7.3 |
| CVE-2019-14540 | 9.8 | Sep 15 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10 Affected: 7.2; 7.3 |
| CVE-2019-14379 | 9.8 | Jul 29 | SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of… Affected: 7.2; 7.3; 7.2; 7.3; 7.2; 7.3 |
| CVE-2018-14720 | 9.8 | Jan 2 | FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from… Affected: 7.2.0 |
| CVE-2017-7464 | 9.8 | Jul 27 | It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws Affected: 7.0 |
| CVE-2017-7465 | 9.8 | Jun 27 | It was found that the JAXP implementation used in JBoss EAP 7.0 for XSLT processing is vulnerable to code injection Affected: 7.0.0 |
| CVE-2018-8088 | 9.8 | Mar 20 | org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data Affected: 7.1; 6.0.0; 6.4.0 |
| CVE-2018-7489 | 9.8 | Feb 26 | FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the… Affected: 6.4.19; 7.1.2 |
| CVE-2017-7525 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by… Affected: 6.0.0; 6.4.0; 7.0; 7.1; 6.0.0; 6.4.0 |
| CVE-2017-15095 | 9.8 | Feb 6 | A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending… Affected: 6.0.0; 6.4.0; 7.1.0 |
| CVE-2017-17485 | 9.8 | Jan 10 | FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization… Affected: 6.0.0; 6.4.0; 7.1; 6.0.0; 6.4.0 |
| CVE-2015-7501 | 9.8 | Nov 9 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;… Affected: 4.3.0; 5.0.0; 6.0.0 |
| CVE-2017-12629 | 9.8 | Oct 14 | Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the… Affected: 7.0.0; 7.1.0 |
| CVE-2016-3690 | 9.8 | Jun 8 | The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload Affected: 4.2.0; 4.3.0; 5.0.0; 5.1.0; 5.1.1; 5.1.2; +1 more |
| CVE-2017-7504 | 9.8 | May 19 | HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss Application Server <= Jboss 4.X does not… Affected: through 4.0 |
| CVE-2017-7503 | 9.8 | May 18 | It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE Affected: 7.0.5 |
| CVE-2016-2141 | 9.8 | Jun 30 | It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster Affected: 5.2; 6.4; 7.0 |
| CVE-2025-12543 | 9.6 | Jan 7 | Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf Affected: 8.0 before 8.0.12; 8.1.0 before 8.1.3; 7.0.0 |
| CVE-2026-28369 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via malformed http request headers Affected: 7.0.0; 8.0.0 |
| CVE-2026-28367 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator Affected: 7.0.0; 8.0.0 |
| CVE-2026-28368 | 9.1 | Mar 27 | Undertow: undertow: request smuggling via inconsistent header parsing Affected: 7.0.0; 8.0.0 |
| CVE-2019-14887 | 9.1 | Mar 16 | A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored Affected: 7.0.0 |
| CVE-2019-20444 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be… Affected: 7.2; 7.3 |
| CVE-2019-20445 | 9.1 | Jan 29 | HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header Affected: 7.2; 7.3 |
| CVE-2016-5018 | 9.1 | Aug 10 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured… Affected: 6.4 |
| CVE-2017-9788 | 9.1 | Jul 13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between… Affected: 6.0.0; 6.4.0 |
| CVE-2019-3873 | 9.0 | Jun 12 | It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML Affected: 7.2.0 |
Showing 36