CVE-2020-1695

CVE-2020-1695 affects RESTEasy, including all 3.x.x versions before 3.12.0.Final and 4.x.x versions before 4.6.0.Final. The issue arises from improper input validation that allows returning an illegal header in the server response, which may enable an injection or cause unexpected HTTP response c...

CVE-2020-1695

A flaw was found in all resteasy 3.x.x versions prior to 3.12.0.Final and all resteasy 4.x.x versions prior to 4.6.0.Final, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to...

resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class

A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.3.8 security update

A security update is now available for Red Hat Single Sign-On 7.3 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Red Hat Resteasy Input Validation Error Vulnerability

Red Hat Resteasy is the United States Red Hat Red Hat, a JAX-RS a Java programming language API specification implementation. An input validation error vulnerability exists in Red Hat Resteasy versions 3.x.x prior to 3.12.0.Final and 4.x.x prior to 4.6.0.Final, which arises from a networked syste...

CVE-2020-1695

A flaw was found in Resteasy, where an improper input validation results in returning an illegal header that integrates into the server's response. This flaw may result in an injection, which leads to unexpected behavior when the HTTP response is constructed...

Cross-site Scripting (XSS)

resteasy-jaxrs is vulnerable to cross-site scripting XSS. The vulnerability exists due to the lack of sanitization of the value of strVal, allowing RESTEASY003870 exceptions be used to execute arbitrary Javascript in a user's browser...

CVE-2020-10688

A cross-site scripting XSS flaw was found in RESTEasy, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack...

PT-2020-6957 · Red Hat +4 · Resteasy +4

Name of the Vulnerable Software and Affected Versions: RESTEasy versions prior to 3.11.1.Final RESTEasy versions prior to 4.5.3.Final Description: A cross-site scripting XSS flaw was found in RESTEasy, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An...

Huawei EulerOS: Security Advisory for resteasy-base (EulerOS-SA-2016-1057)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-3599

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...

Xxe

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...

CVE-2014-3599

HornetQ REST is vulnerable to XML External Entity due to insecure configuration of RestEasy...

CVE-2014-3599

The provided documents confirm CVE-2014-3599 concerns HornetQ REST being vulnerable to an XML External Entity (XXE) flaw caused by insecure RestEasy configuration. Concrete technical details available include the vulnerability type (XXE) and the affected component (HornetQ REST). The sources refe...

CVE-2016-9606

It was discovered that under certain conditions RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of potentially untrusted data. An attacker could possibly use this flaw execute arbitrary code with the permissions of the application using RESTEasy. Mitigati...

PT-2019-6418 · Red Hat +5 · Resteasy +6

Name of the Vulnerable Software and Affected Versions: resteasy versions 3.x.x prior to 3.12.0.Final resteasy versions 4.x.x prior to 4.6.0.Final Description: A flaw was found in resteasy where an improper input validation results in returning an illegal header that integrates into the server's...

RESTEasy: Abuse of GZIPInterceptor in RESTEasy can lead to denial of service attack

It was found that GZIPInterceptor is enabled when not necessarily required in RESTEasy. An attacker could use this flaw to launch a Denial of Service attack...

RHEL 7 : Satellite 6.5 Release (Moderate) (RHSA-2019:1222)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1222 advisory. Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning, remote management, and monitoring...

Remote Code Execution (RCE)

RESTEasy is vulnerable to remote code execution. SnakeYAML unmarshalling is exploitable for code execution. As RESTeasy uses SnakeYAML and enables the yaml provider by default, under certain conditions, RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of...

Denial Of Service (DoS)

resteasy-jaxrs is vulnerable to denial of service attacks. The vulnerability is possible because GZIPInterceptor is enabled in RESTEasy even though it is not required...