WildFly has incomplete blacklist vulnerability

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly formerly JBoss Application Server before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the 1 WEB-INF or 2 META-INF directory via a request that contains a lowercase or b...

Improper Limitation of a Pathname to a Restricted Directory in WildFly

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability...

GHSA-W8R2-5J8X-X8J6 Improper Limitation of a Pathname to a Restricted Directory in WildFly

WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability...

Red Hat Wildfly DoS

Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers...

GHSA-P4XG-CPR9-VWVJ Red Hat Wildfly DoS

Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, up to "max-headers...

Jenkins wildFly Deployer Plugin stores credentials in plain text

Jenkins WildFly Deployer Plugin stores deployment credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

GHSA-8J62-29JG-6HJ6 Jenkins wildFly Deployer Plugin stores credentials in plain text

Jenkins WildFly Deployer Plugin stores deployment credentials unencrypted in job config.xml files on the Jenkins controller. These credentials can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-0866

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the...

Design/Logic Flaw

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the...

CVE-2022-0866

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the...

CVE-2022-0866

CVE-2022-0866 describes a concurrency issue in the EJB session context for RunAs-enabled components (EJBComponent) in JBoss/WildFly Elytron. The incomingRunAsIdentity field, currently a SecurityIdentity, can be concurrently accessed, causing getCallerPrincipal and isCallerInRole to return the wro...

CVE-2022-0866

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the...

CVE-2022-0866

A flaw was found in Wildfly, where it returns an incorrect caller principal under certain heavily concurrent situations when Elytron Security is used. This flaw allows an attacker to gain improper access to information they should not have. Mitigation In order to avoid the possibility of...

Wildfly 安全漏洞

Wildfly is a powerful, modular and lightweight application server from Wildfly. A security vulnerability exists in WildFly that stems from the fact that when Elytron Security is used, it returns the wrong caller body in certain highly concurrent scenarios...

org.wildfly:wildfly-microprofile-metrics-smallrye (>=22.0.0.Beta1 <=23.0.0.Final) potentially affected by CVE-2021-3503 via org.wildfly:wildfly-metrics (>=22.0.0.Beta1 <=23.0.0.Final)

org.wildfly:wildfly-metrics MAVEN version =22.0.0.Beta1, =22.0.0.Beta1, =23.0.0.Final Source cves: CVE-2021-3503 Source advisory: OSV:GHSA-C4R5-XVGW-2942...

GHSA-C4R5-XVGW-2942 Metrics exposure in Wildfly

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data...

Metrics exposure in Wildfly

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data...

CVE-2021-3503

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality...

CVE-2021-3503

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality...

CVE-2021-3503

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality...