5735 matches found
wildPwn
wildPwn - WildFly Exploitation Tool It is a tool for WildFly. Tool can be used to brute force or shell deploy. wildPwn.war contains modified Laudanum Shell. userList.txt contains common usernames and passList.txt contains common passwords. Usage Bruteforce python wildPwn.py -m brute --target -use...
wildfly__wildfly_CVE-2018-1047_11-0-0-Final
WildFly Application Server http://wildfly.org Fast Startup Small Footprint Modular Design Unified Configuration and Management And of course Java EE7! Building Prerequisites: JDK 8 or newer - check java -version Maven 3.3.1 or newer - check mvn -v On nix systems, make sure that the maximum number...
CVE-2026-15564
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and dependi...
CVE-2026-114488
A flaw in Wildfly allows a remote attacker to bypass authentication on IIOP EJB invocations. The CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, enabling a pre-auth attacker on port 3528 to impersonat...
EUVD-2026-112635
A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to...
EUVD-2026-112633
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and dependi...
CVE-2026-15564
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and dependi...
CVE-2026-15564
The Wildfly IIOP listener may permit deserialization of input streams before authentication is performed. An attacker with access to the IIOP port (default TCP port 3528 ) could send malicious objects to achieve deserialization, provided the target EJB allows untyped method parameters and suitabl...
CVE-2026-15564 Wildfly-ejb: wildfly-iiop-openjdk: eap iiop listeners may permit unauthed deserialization
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and dependi...
CVE-2025-12543-Fix-for-Wildfly
WildFly 11.0.0.Final Base Image — CVE-2025-12543 Patch Overview This repository provides a Docker base image built on WildFly 11.0.0.Final with a backported fix for CVE-2025-12543 , a critical Host header validation vulnerability in Undertow. The image is intended to be provided to colleagues as ...
CVE-2026-114488
A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to...
CVE-2026-15564
Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to the IIOP port may be able to construct and send malicious objects and achieve deserialization, if the target EJB allows untyped method parameters, and dependi...
CLEANSTART-2026-YS58315 In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS
Security vulnerability affects the wildfly package. In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS...
CLEANSTART-2026-JA94279 Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module
Security vulnerability affects the wildfly package. Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security module...
CLEANSTART-2026-EX41595 CompressionUtils
Security vulnerability affects the wildfly package. CompressionUtils...
CLEANSTART-2026-VE39696 Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from...
Security vulnerability affects the wildfly package. Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain multiple valid access tokens from a single authorization code via concurrent toke...
CLEANSTART-2026-NU72264 Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication
Security vulnerability affects the wildfly package. Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after successful authentication...
CLEANSTART-2026-XT41659 Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions
Security vulnerability affects the wildfly package. Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions...
CLEANSTART-2026-RF61847 In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attachment-headers-max-count (defau...
Security vulnerability affects the wildfly package. In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size default 300 characters and attachment-headers-max-count default 500 limits...
CLEANSTART-2026-YB05084 In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the host being called
Security vulnerability affects the wildfly package. In Apache CXF, the Netty-based HTTP client transport cxf-rt-transports-http-netty-client did not verify that the hostname in the server’s TLS certificate matched the host being called...