CVE-2020-25680

CVE-2020-25680 is a vulnerability in JBoss Core Services Apache HTTP Server (JBCS httpd) affecting the 2.4.37 line (notably SP3 in the CVE entry; RHSA-2020:4384 references SP5). The issue allows connecting to a backend worker via SSL when the backend keystore file’s ID is 'unknown', due to broken...

CVE-2021-3688

CVE-2021-3688 affects Red Hat JBoss Core Services HTTP Server (all versions). The root cause is improper normalization of the path component in URL requests that contain dot-dot-semicolon(s), which could allow an attacker to access unauthorized information and potentially facilitate further attac...