wildfly-elytron: possible timing attack in ScramServer

A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality...

Important: Red Hat Security Advisory: Red Hat support for Spring Boot 2.5.10 update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For...

RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.4.4 (RHSA-2022:1296)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2022:1296 advisory. Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release o...

CVE-2022-1278

A flaw was found in WildFly. This flaw allows an attacker to see deployment names, endpoints, and any other data the trace payload may contain...

WildFly 安全漏洞

Wildfly is a powerful, modular and lightweight application server from Wildfly. WildFly has a security vulnerability that stems from the presence of an information leak. An attacker exploiting the vulnerability could see the deployment name, endpoints, and any data that the tracking payload may...

Red Hat Undertow 资源管理错误漏洞

Red Hat Undertow is a Java-based embedded web server from Red Hat and is the default web server for Wildfly Java Application Server. Red Hat Undertow suffers from a security vulnerability that stems from a potential security issue in HTTP/2 flow control could lead to DOS...

Information Disclosure

org.wildfly.transaction:wildfly-transaction-client is vulnerable to information disclosure. A remote unauthenticated attacker is able to cause a memory leak by using UserTransaction repeatedly causing sensitive information leakage...

Session Fixation in WildFly Elytron

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

GHSA-7FHR-2694-RG79 Session Fixation in WildFly Elytron

A flaw was found in WildFly Elytron version 1.11.3.Final and before. When using WildFly Elytron FORM authentication with a session ID in the URL, an attacker could perform a session fixation attack. The highest threat from this vulnerability is to data confidentiality and integrity as well as...

br.eti.clairton:ds-test (=0.4.0), com.bertoncelj.wildflysingletonservice:wildfly-singleton-service (>=1.1.0 <=1.2.1) +401 more potentially affected by CVE-2020-10714 via org.wildfly.security:wildfly-elytron (>=1.0.0.Alpha1 <=1.11.3.Final)

org.wildfly.security:wildfly-elytron MAVEN version =1.0.0.Alpha1, =1.1.0, =0.7.0, =2.6.0.Final, =2.6.0.Final, =2.6.0.Final, =1.9.0, =2.6.0.Final, =1.8.1, =1.8.1, =1.8.1, =2.6.0.Final, =2.6.0.Final, =2.6.0.Final, =2.7.0.Final and more Source cves: CVE-2020-10714 Source advisory:...

Incorrect Authorization in WildFly Elytron

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secur...

br.eti.clairton:ds-test (>=0.4.0 <=1.1.0), br.unb.erlangms:ems_java (=1.0.8.8) +864 more potentially affected by CVE-2020-1748 via org.wildfly.security:wildfly-elytron (>=1.0.0.Alpha1 <=1.6.7.Final)

org.wildfly.security:wildfly-elytron MAVEN version =1.0.0.Alpha1, =0.4.0, =1.1.0, =1.6.10, =1.6.10, =2020.10.30-4240, =2020.10.30-4240, =2.3.0, =2.3.0, =2.3.0, =6.2.0, =0.1.0, =1.2.6, =1.2.6, =1.3.19 and more Source cves: CVE-2020-1748 Source advisory...

GHSA-QGRQ-CX4C-2RMM Incorrect Authorization in WildFly Elytron

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secur...

Wildfly logs plaintext passwords

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file...

GHSA-JW3V-5CH2-WFMM Wildfly logs plaintext passwords

A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file...

Improper Input Validation in Xerces

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This iss...

GHSA-W4JQ-QH47-HVJQ Improper Input Validation in Xerces

A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This iss...

wildfly-elytron: possible timing attack in ScramServer

A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4 security update

A security update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...