JE
Product
Jboss Enterprise Web Server
On CISA KEVExploited in the wildRansomware-linked
35
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 16Medium 5Low 1
Watch
Add Jboss Enterprise Web Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-8735 In wildKEV | 9.8 | Apr 6 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if… Affected: 3.0.0 |
| CVE-2017-12617 In wildKEV | 8.1 | Oct 3 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 2.0.0; 3.0.0 |
| CVE-2017-12615 RansomwareIn wildKEV | 8.1 | Sep 19 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g Affected: 2.0.0; 3.0.0 |
| CVE-2014-3699 | 9.8 | Dec 15 | eDeploy has RCE via cPickle deserialization of untrusted data Affected: 1.0.0 |
| CVE-2014-3700 | 9.8 | Nov 21 | eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data Affected: 1.0.0 |
| CVE-2011-3923 | 9.8 | Nov 1 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands Affected: 1.0.0 |
| CVE-2015-7501 | 9.8 | Nov 9 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;… Affected: 3.0.0 |
| CVE-2016-5018 | 9.1 | Aug 10 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured… Affected: 3.0.0 |
| CVE-2017-9788 | 9.1 | Jul 13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between… Affected: 2.0.0 |
| CVE-2014-3701 | 8.1 | Dec 15 | eDeploy has tmp file race condition flaws Affected: 1.0.0 |
| CVE-2016-5387 | 8.1 | Jul 19 | The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY… Affected: 2.0.0; 3.0.0; 2.0.0; 3.0.0 |
| CVE-2020-25710 | 7.5 | May 28 | A flaw was found in OpenLDAP in versions before 2.4.56 Affected: 2.0.0 |
| CVE-2012-5626 | 7.5 | Jan 23 | EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform… Affected: 1.0.0 |
| CVE-2019-19906 | 7.5 | Dec 19 | cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet Affected: 2.0.0 |
| CVE-2018-1336 | 7.5 | Aug 2 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service Affected: 3.0.0; 5.0.0 |
| CVE-2015-5184 | 7.5 | Sep 25 | Console: CORS headers set to allow all in Red Hat AMQ Affected: 1.0.0 |
| CVE-2015-5183 | 7.5 | Sep 25 | Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ Affected: 1.0.0 |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 3.0.0 |
| CVE-2016-6797 | 7.5 | Aug 10 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web… Affected: 3.0.0 |
| CVE-2016-3110 | 7.5 | Sep 26 | mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of =… Affected: 2.0.0; 2.1 |
| CVE-2016-2183 | 7.5 | Sep 1 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which… Affected: 1.0.0; 2.0.0 |
| CVE-2014-0224 | 7.4 | Jun 5 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers… Affected: 2.0.1 |
| CVE-2017-12613 | 7.1 | Oct 24 | When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be… Affected: 3.0.0 |
| CVE-2019-1559 | 5.9 | Feb 27 | 0-byte record padding oracle Affected: 5.0.0 |
| CVE-2018-1304 | 5.9 | Feb 28 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49… Affected: 3.0.0 |
| CVE-2016-0762 | 5.9 | Aug 10 | The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied… Affected: 3.0.0 |
| CVE-2016-6794 | 5.3 | Aug 10 | When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager Affected: 3.0.0 |
| CVE-2014-3655 | 4.3 | Nov 13 | JBoss KeyCloak is vulnerable to soft token deletion via CSRF Affected: 1.0.0 |
| CVE-2012-2148 | 3.3 | Dec 6 | An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies Affected: 1.0.0 |
| CVE-2013-5704 | – | Apr 15 | The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent… Affected: 3.0.0; 2.0.0 |
| CVE-2013-2186 | – | Oct 28 | The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote… Affected: 1.0.2 |
| CVE-2013-1976 | – | Jul 9 | The (1) tomcat5, (2) tomcat6, and (3) tomcat7 init scripts, as used in the RPM distribution of Tomcat for JBoss Enterprise Web Server 1.0.2 and 2.0.0, and Red Hat Enterprise Linux… Affected: 1.0.2; 2.0.0 |
| CVE-2012-0053 | – | Jan 28 | protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows… Affected: 1.0.0 |
| CVE-2012-0031 | – | Jan 18 | scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other… Affected: 1.0.0 |
| CVE-2011-3348 | – | Sep 20 | The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service… Affected: 1.0.0 |
Showing 35