JF
Product
Jboss Fuse
41
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 16Medium 10Low 3
Watch
Add Jboss Fuse to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-14892 | 9.8 | Mar 2 | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using… Affected: 7.0.0 |
| CVE-2019-10212 | 9.8 | Oct 2 | A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security Affected: 7.0.0 through 7.4 |
| CVE-2014-0121 | 9.8 | Dec 29 | The admin terminal in Hawt.io does not require authentication, which allows remote attackers to execute arbitrary commands via the k parameter Affected: 6.1.0 |
| CVE-2015-7501 | 9.8 | Nov 9 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x;… Affected: 6.0.0 |
| CVE-2019-14887 | 9.1 | Mar 16 | A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored Affected: 7.0.0 |
| CVE-2017-2589 | 9.0 | Jul 26 | It was discovered that the hawtio servlet 1.4 uses a single HttpClient instance to proxy requests with a persistent cookie store (cookies are stored locally and are not passed… Affected: 6.3 |
| CVE-2020-1714 | 8.8 | May 13 | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks Affected: 7.0.0 |
| CVE-2020-1718 | 8.8 | May 12 | A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0 Affected: 7.0.0 |
| CVE-2014-0120 | 8.8 | Dec 29 | Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote attackers to hijack the authentication of arbitrary users for requests that run… Affected: 6.1.0 |
| CVE-2020-1757 | 8.1 | Apr 21 | A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet… Affected: 6.0.0; 7.0.0 |
| CVE-2024-7885 | 7.5 | Aug 21 | Undertow: improper state management in proxy protocol parsing causes information leakage Affected: 7.0.0 |
| CVE-2022-4492 | 7.5 | Feb 23 | The undertow client is not checking the server identity presented by the server certificate in https connections Affected: 7.0.0 |
| CVE-2022-2053 | 7.5 | Aug 5 | When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection… Affected: 7.0.0 |
| CVE-2021-4104 | 7.5 | Dec 14 | JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration Affected: 6.0.0; 7.0.0 |
| CVE-2020-27782 | 7.5 | Feb 23 | A flaw was found in the Undertow AJP connector Affected: 6.0.0; 7.0.0 |
| CVE-2020-25644 | 7.5 | Oct 6 | A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session Affected: 7.0.0 |
| CVE-2020-10714 | 7.5 | Sep 23 | A flaw was found in WildFly Elytron version 1.11.3.Final and before Affected: 7.0.0 |
| CVE-2020-10718 | 7.5 | Sep 16 | A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Thread Context Classloader (TCCL) Affected: 7.0.0 |
| CVE-2019-14888 | 7.5 | Jan 23 | A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS Affected: 6.0.0; 7.0.0 |
| CVE-2019-10172 | 7.5 | Nov 18 | A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries Affected: 7.0.0 |
| CVE-2021-20218 | 7.4 | Mar 16 | A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after Affected: 7.0.0 |
| CVE-2016-8648 | 7.2 | Aug 1 | It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x, deserializes objects passed to MBeans via JMX operations Affected: 6.0.0 |
| CVE-2020-25689 | 6.5 | Nov 2 | A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly… Affected: 7.0.0 |
| CVE-2020-14307 | 6.5 | Jul 24 | A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote… Affected: 6.0.0 |
| CVE-2020-14297 | 6.5 | Jul 24 | A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause… Affected: 6.0.0 |
| CVE-2016-1000229 | 6.1 | Dec 20 | swagger-ui has XSS in key names Affected: 6.3 |
| CVE-2020-14340 | 5.9 | Jun 2 | A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles Affected: 6.0.0; 7.0.0 |
| CVE-2017-12196 | 5.9 | Apr 18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the… Affected: 6.0.0 |
| CVE-2021-3642 | 5.3 | Aug 5 | A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if… Affected: 7.0.0 |
| CVE-2016-8653 | 5.3 | Aug 1 | It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the credentials passed to it Affected: 6.0.0 |
| CVE-2022-2764 | 4.9 | Sep 1 | A flaw was found in Undertow Affected: 7.0.0 |
| CVE-2019-14820 | 4.3 | Jan 8 | It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL Affected: 7.0.0 |
| CVE-2020-10734 | 3.3 | Feb 11 | A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection Affected: 7.0.0 |
| CVE-2020-1717 | 2.7 | Feb 11 | A flaw was found in Keycloak 7.0.1 Affected: 7.0.0 |
| CVE-2015-7559 | 2.7 | Aug 1 | It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class Affected: 6.3 |
| CVE-2014-8175 | – | Jul 8 | Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveraging an account defined in the… Affected: through 6.1.0 |
| CVE-2013-7398 | – | Jun 24 | main/java/com/ning/http/client/AsyncHttpClientConfig.java in Async Http Client (aka AHC or async-http-client) before 1.9.0 does not require a hostname match during verification of… Affected: through 6.1.0 |
| CVE-2013-7397 | – | Jun 24 | Async Http Client (aka AHC or async-http-client) before 1.9.0 skips X.509 certificate verification unless both a keyStore location and a trustStore location are explicitly set,… Affected: through 6.1.0 |
| CVE-2014-5075 | – | Oct 25 | The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is used, does not verify that the server hostname matches a domain name in the… Affected: through 6.1.0 |
| CVE-2014-0085 | – | Apr 17 | JBoss Fuse did not enable encrypted passwords by default in its usage of Apache Zookeeper Affected: 6.0.0 |
| CVE-2013-4372 | – | Sep 30 | Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3 allow remote… Affected: 6.0.0 |
Showing 41