JE
Product
Jboss Enterprise Web Server
On CISA KEVExploited in the wildRansomware-linked
35
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 16Medium 5Low 1
Watch
Add Jboss Enterprise Web Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-12617 In wildKEV | 8.1 | Oct 3 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g Affected: 2.0.0; 3.0.0 |
| CVE-2017-12615 RansomwareIn wildKEV | 8.1 | Sep 19 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g Affected: 2.0.0; 3.0.0 |
| CVE-2014-3701 | 8.1 | Dec 15 | eDeploy has tmp file race condition flaws Affected: 1.0.0 |
| CVE-2016-5387 | 8.1 | Jul 19 | The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY… Affected: 2.0.0; 3.0.0; 2.0.0; 3.0.0 |
| CVE-2020-25710 | 7.5 | May 28 | A flaw was found in OpenLDAP in versions before 2.4.56 Affected: 2.0.0 |
| CVE-2012-5626 | 7.5 | Jan 23 | EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform… Affected: 1.0.0 |
| CVE-2019-19906 | 7.5 | Dec 19 | cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet Affected: 2.0.0 |
| CVE-2018-1336 | 7.5 | Aug 2 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service Affected: 3.0.0; 5.0.0 |
| CVE-2015-5184 | 7.5 | Sep 25 | Console: CORS headers set to allow all in Red Hat AMQ Affected: 1.0.0 |
| CVE-2015-5183 | 7.5 | Sep 25 | Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ Affected: 1.0.0 |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 3.0.0 |
| CVE-2016-6797 | 7.5 | Aug 10 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web… Affected: 3.0.0 |
| CVE-2016-3110 | 7.5 | Sep 26 | mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of =… Affected: 2.0.0; 2.1 |
| CVE-2016-2183 | 7.5 | Sep 1 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which… Affected: 1.0.0; 2.0.0 |
| CVE-2014-0224 | 7.4 | Jun 5 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers… Affected: 2.0.1 |
| CVE-2017-12613 | 7.1 | Oct 24 | When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be… Affected: 3.0.0 |
Showing 16