Jboss Enterprise Application Platform Security Vulnerabilities and Issues — Jboss Enterprise Application Platform CVE List

Lucene search

RedhatJboss Enterprise Application Platform

9 matches found

CVE•added 2022/05/24 7:15 p.m.•280 views

CVE-2021-3629

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over http/2 may potentially cause overhead or a denial of service in the server. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.40.Final and...

5.9CVSS6AI score0.00093EPSS

CVE•added 2022/08/23 4:15 p.m.•279 views

CVE-2021-3690

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

7.5CVSS7.1AI score0.00557EPSS

CVE•added 2022/08/26 4:15 p.m.•227 views

CVE-2021-3859

A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2. This flaw allows an attacker to carry out denial of service attacks.

7.5CVSS7.1AI score0.00191EPSS

CVE•added 2022/05/24 7:15 p.m.•218 views

CVE-2021-3717

A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_USER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability. This flaw affects wildfl...

7.8CVSS7.2AI score0.0004EPSS

CVE•added 2022/05/24 7:15 p.m.•217 views

CVE-2021-3597

A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of service. The highest threat from this vulnerability is availability. This flaw affects Undertow versions prior to 2.0.35.SP1, prior to 2.2.6.SP1, prior to 2.2.7.SP1...

5.9CVSS5.5AI score0.00162EPSS

CVE•added 2022/09/01 9:15 p.m.•217 views

CVE-2022-2764

A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations.

4.9CVSS5.1AI score0.00105EPSS

CVE•added 2022/08/31 4:15 p.m.•141 views

CVE-2022-1259

A flaw was found in Undertow. A potential security issue in flow control handling by the browser over HTTP/2 may cause overhead or a denial of service in the server. This flaw exists because of an incomplete fix for CVE-2021-3629.

7.5CVSS6.3AI score0.00156EPSS

CVE•added 2022/03/11 6:15 p.m.•134 views

CVE-2022-0853

A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.

7.5CVSS7.1AI score0.017EPSS

CVE•added 2022/05/10 9:15 p.m.•128 views

CVE-2022-0866

This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org....

5.3CVSS5.3AI score0.002EPSS