wildfly__wildfly_CVE-2018-1047_11-0-0-Final

WildFly 应用服务器 http://wildfly.org 快速启动 体积小巧 模块化设计 统一配置与管理 当然还有 Java EE7！ 构建 前提条件： JDK 8 或更新版本 - 检查 java -version Maven 3.3.1 或更新版本 - 检查 mvn -v 在 nix 系统上，确保运行构建的用户打开文件的最大数量至少为 4096 （检查 ulimit -n）或更多，具体取决于用户正在运行的其他 I/O 密集型进程。 使用您自己安装的 Maven 进行构建： root@kitploit: mvn install 或者，您可以使用 Maven Wrapper...

CLEANSTART-2026-TK74523 Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place

Security vulnerability affects the wildfly package. Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place...

CVE-2026-10832

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

CVE-2026-85511

A parameter injection flaw was identified in Red Hat EAP's Elytron security subsystem. Specifically, an EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection allows parameter substitution due to missing URL encoding . The vulnerability is rated MEDIUM...

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-10832 Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

EUVD-2026-82936

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

CVE-2026-10832

A resource exhaustion flaw in the DERDecoder class within wildfly-elytron-asn1 allows a remote attacker to cause JVM memory exhaustion by sending a specially crafted DER payload with an inflated length value that is allocated without proper validation. This leads to a remote Denial of Service for...

CVE-2026-10832

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

wildPwn

wildPwn - WildFly 利用工具 这是一个用于 WildFly 的工具。该工具可用于暴力破解或 Shell 部署。 wildPwn.war 包含修改后的 Laudanum Shell。 userList.txt 包含常见用户名， passList.txt 包含常见密码。 用法 暴力破解 root@kitploit: python wildPwn.py -m brute --target -user -pass Shell 部署 root@kitploit: python wildPwn.py -m deploy --target --port -u -p 详情...

CVE-2025-12543-Fix-for-Wildfly

Imagen Base WildFly 11.0.0.Final — Parche CVE-2025-12543 Resumen Este repositorio proporciona una imagen base Docker construida sobre WildFly 11.0.0.Final con una corrección retroportada para CVE-2025-12543 , una vulnerabilidad crítica de validación del encabezado Host en Undertow. La imagen está...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

wildfly-messaging-activemq-subsystem: artemis-server: jgroups: artemis cluster password leak via jgroups spoof

Artemis and JGroups lack of access controls in certain situations can allow an attacker to spoof a password request in JGroups and subsequently gain access to the cluster. This allows the attacker manage-level authority for provided messaging and queue operations...

artemis-server: undertow-core: wildfly-messaging-activemq-subsystem: artemis core protocol permits unauthed queue creation

Artemis CORE protocol channel allows unauthed queue creation. an unauthenticated attacker can send CREATEQUEUE packets on channel 1 via the :8080 HTTP-upgrade path to create arbitrary durable JMS queues on the embedded broker. This can be used for resource exhaustion and persistent broker-state...

CVE-2026-81624

Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a...

Linux Distros Unpatched Vulnerability : CVE-2026-81624

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certai...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: wildfly-security-manager (UTSA-2026-030642)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-030642 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-elytron (UTSA-2026-031644)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031644 advisory. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non- default configurations. This could allows attackers with...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-common (UTSA-2026-093018)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093018 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...