CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2021-4104

CVE-2021-4104 affects JMSAppender in Log4j 1.2 when it is explicitly configured to use JMSAppender. A deserialization of untrusted data can occur if an attacker can write Log4j configuration and supply TopicBindingName and TopicConnectionFactoryBindingName, causing JMSAppender to perform JNDI req...

CVE-2019-10172

CVE-2019-10172 describes an XML External Entity (XXE) vulnerability in org.codehaus.jackson:jackson-mapper-asl:1.9.x (Codehaus Jackson). Connected sources confirm the flaw affecting jackson-mapper-asl libraries and note that CVE-2016-3720 affects related code, in different classes. Public advisor...

CVE-2017-12196

CVE-2017-12196 affects Undertow when using Digest authentication. The vulnerability exists because Undertow does not ensure that the URI in the Authorization header matches the HTTP request line, enabling a MITM-like scenario to access content. Affected are Undertow releases prior to 1.4.18.SP1, ...

CVE-2024-7885

CVE-2024-7885 affects Undertow's ProxyProtocolReadListener, where parseProxyProtocolV1 reuses a single StringBuilder across multiple requests, potentially leaking data between requests on the same HTTP connection and, in multi-request environments, exposing previous values. The connected Red Hat ...

CVE-2015-7501

CVE-2015-7501 involves a deserialization flaw in Apache Commons Collections that affects Red Hat JBoss Middleware stack (A-MQ 6.x; BPMS 6.x; BRMS 5.x/6.x; JDG 6.x/5.x; JDV 6.x/5.x; AEP 6.x; Fuse 6.x; FSW 6.x; JBoss ON 3.x; Portal 6.x; SOA-P 5.x; JWS 3.x; OpenShift/xPaaS 3.x; Subscription Asset Ma...

CVE-2022-2053

CVE-2022-2053 affects Undertow’s AJP handling: when a POST through AJP exceeds maxEntitySize, AjpServerRequestConduit closes the connection without a response, potentially causing front-end proxies to mark the backend as in error state andCausing DoS via service interruptions. The Nessus NASL ent...

CVE-2022-2764

CVE-2022-2764 concerns Undertow. A DoS can occur because the Undertow server waits for LAST_CHUNK forever during EJB invocations, impacting availability (per CVSS vector: Network, Low access, High impact to availability). Public details in the provided documents specify the vulnerability as a DoS...

CVE-2019-14892

CVE-2019-14892 — In jackson-databind, polymorphic deserialization can be exploited via JNDI gadgets (commons-configuration 1/2) to achieve remote code execution. Affected: jackson-databind versions before 2.9.10, 2.8.11.5, and 2.6.7.3. Remediation: upgrade to a fixed jackson-databind release (e.g...

CVE-2020-27782

The CVE-2020-27782 issue affects Undertow’s AJP connector. A flaw allows an attacker to trigger denial of service by sending malicious requests or causing abrupt connection closes when query strings use non-RFC compliant characters, potentially impacting availability. Affected versions are Undert...

CVE-2021-20218

The CVE refers to fabric8 kubernetes-client vulnerability affecting version 4.2.0 and later, where a malicious pod/container can abuse the client’s copy command to extract files outside the working path, impacting integrity and availability. Fixed in kubernetes-client releases 4.13.2, 5.0.2, 4.11...

CVE-2019-10212

CVE-2019-10212 affects Undertow (under 2.0.20) where DEBUG logging of io.undertow.request.security can leak user credentials from log files. Reported in multiple sources (including OSV entries and CNVD) as a log-file disclosure vulnerability with network-based access and high confidentiality/inte...

CVE-2020-25644

CVE-2020-25644 is a memory‑leak vulnerability in WildFly OpenSSL (WildFly OpenSSL natives) prior to 1.1.3.Final. The flaw causes a memory leak per HTTP session creation, which can lead to Out-Of-Memory and a denial of service, predominantly affecting availability. Affected component/file: WildFly...

CVE-2022-4492

CVE-2022-4492 is linked to Undertow: the undertow client does not verify the server identity presented by the server certificate in HTTPS connections, a TLS-level check that should be performed by default. This can enable weaknesses in TLS client verification and potential MITM scenarios. Connect...

CVE-2021-3642

CVE-2021-3642 describes a timing-attack vulnerability in Wildfly Elytron’s ScramServer, affecting versions prior to 1.10.14.Final, 1.15.5.Final, and 1.16.1.Final. The highest impact is confidentiality; no exploitation details are provided in the documents. Connected advisories (e.g., Red Hat RHSA...

CVE-2019-14888

CVE-2019-14888 affects the Undertow HTTP server prior to version 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to cause a Denial of Service, rendering the SSL service unavailable. The description in the provided documents does not specify exploitable details beyond thi...

CVE-2020-1757

The connected Red Hat advisory RHSA-2024:5856 confirms CVE-2020-1757 in Undertow: servletPath normalization could truncate a path after a semicolon, enabling dangerous application mapping and a security bypass. Affected products/versions include Undertow-based components within Red Hat JBoss EAP ...

CVE-2020-1714

Keycloak before 11.0.0 contains usages of ObjectInputStream without type checks, allowing deserialization of arbitrary Java objects in a privileged context and potentially enabling remote code execution (CVE-2020-1714). References associate this CVE with Red Hat advisories noting Keycloak as the ...

CVE-2015-7559

CVE-2015-7559: Apache ActiveMQ client before 5.14.5 exposes a remote shutdown command in ActiveMQConnection, enabling a remote authenticated attacker to cause denial of service on a connected client. Affected software is the Apache ActiveMQ client (pre-5.14.5). Remediation: upgrade to 5.14.5 or l...

CVE-2020-14297

Technical details for CVE-2020-14297 are not publicly provided in the supplied connected documents. Monitor for updates.

CVE-2020-10714

CVE-2020-10714 concerns WildFly Elytron prior to 1.11.3.Final. A flaw in FORM authentication with a session ID in the URL enables a session fixation attack, affecting confidentiality, integrity, and availability. The impact is stated in the sources as high (CVSS 3.1) with network access and user ...

CVE-2020-25689

CVE-2020-25689 : In WildFly, all versions up to 21.0.0.Final exhibit a memory-leak in the host-controller when reconnection attempts loop, causing new connections to be created but not properly closed. This can trigger an Out of Memory (OOM) condition and denial of service, primarily affecting av...

CVE-2020-14340

CVE-2020-14340 affects XNIO prior to the fix in RHSA-2020:4246. A file descriptor leak occurs due to growing NIO Selector handles across garbage collection cycles, enabling a denial-of-service condition. Affected: XNIO 3.6.0.Beta1 through 3.8.1.Final. Root cause: leak in file descriptor managemen...

CVE-2020-14307

CVE-2020-14307 affects WildFly’s EJB components shipped with Red Hat JBoss EAP 7. SessionOpenInvocations are not removed from the remote InvocationTracker after a response, on both client and server. This can cause a denial of service, making the service unavailable. The provided documents do not...

CVE-2020-1718

CVE-2020-1718 affects Keycloak: a flaw in the reset credential flow in all Keycloak versions before 8.0.0 allows an attacker to gain unauthorized access to the application. This is corroborated by the GHSA entry describing the same issue. Exploitation status and remediation details are not provid...

CVE-2019-14887

CVE-2019-14887 affects WildFly when using the OpenSSL security provider: the configured enabled-protocols setting is not honored, allowing downgrading TLS for traffic and potentially leaking data. Affected WildFly releases include 7.2.0.GA, 7.2.3.GA, and 7.2.5.CR2. The issue is referenced in Red ...

CVE-2019-14820

In Keycloak, versions before 8.0.0 expose internal adapter endpoints via org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This could allow an attacker to access unauthorized information. Affected: Keycloak

CVE-2020-10718

The CVE-2020-10718 entry concerns WildFly prior to wildfly-embedded-13.0.0.Final, where the embedded managed process API publicly exposes the Thread Context ClassLoader (TCCL) setting. This exposure can bypass the security manager, with confidentiality identified as the highest threat. Public ref...

CVE-2020-1717

Keycloak 7.0.1 contains an account email enumeration issue where a logged-in user can determine whether an email is associated with an existing account. The CVE entry notes a low overall CVSS v3.1 base score (2.7) with Confidentiality impact as the primary concern; Privileges Required is High, an...

CVE-2020-10734

Keycloak is affected by CVE-2020-10734 due to missing CSRF protection on the OIDC logout endpoint. The vulnerability is described across multiple sources as affecting Keycloak implementations used with Red Hat Fuse 7, Red Hat SSO 7, and Red Hat OpenShift Application Runtimes, with the OIDC logout...

CVE-2017-2589

The vulnerability CVE-2017-2589 affects hawtio servlet 1.4, where a single HttpClient instance proxies requests with a persistent cookie store, causing cookies to be stored locally and shared across all proxy clients. As a result, all users of the proxy share the same cookies, potentially exposin...

CVE-2013-7397

Async Http Client (AHC) prior to 1.9.0 fails to verify X.509 certificates unless both a keystore and a truststore are explicitly configured, enabling MITM via spoofed certificates in typical configurations. Affected component is the AHC Java library; exploitation would involve HTTPS usage with mi...

CVE-2013-7398

CVE-2013-7398 affects Async Http Client (async-http-client) before 1.9.0, where hostname verification is not required during X.509 certificate verification. This allows MITM attackers to spoof HTTPS servers with arbitrary valid certificates. Mitigation: upgrade to 1.9.0 or newer (vendor advisorie...

CVE-2016-1000229

Swagger-UI CVE-2016-1000229: Cross-site scripting via key names in the JSON document. Root cause: improper validation of user-supplied input in Swagger UI. Impact: remote attacker could execute script in a victim’s browser within the hosting site’s security context. Remediation (per Red Hat IBM a...

CVE-2014-0085

CVE-2014-0085 affects JBoss Fuse where the application’s usage of Apache Zookeeper did not have passwords encrypted by default, enabling sensitive information disclosure via local-access logs. The vulnerability is an information disclosure flaw: a local user who can access the log files could obt...

CVE-2016-8648

CVE-2016-8648 affects the Karaf container used by Red Hat JBoss Fuse 6.x and Red Hat JBoss A-MQ 6.x. The vulnerability arises from deserializing objects passed to MBeans via JMX operations, which could allow an attacker to execute remote code in the context of the JVM if deserialization gadgets e...

CVE-2014-5075

CVE-2014-5075 : The Ignite Realtime Smack XMPP API (4.x before 4.0.2; 3.x and 2.x when a custom SSLContext is used) does not verify that the SSL certificate’s CN or SAN matches the server hostname, enabling man-in-the-middle with an arbitrary valid certificate. This is a hostname verification fla...

CVE-2014-0121

CVE-2014-0121 affects Hawt.io: the admin terminal does not require authentication, allowing remote attackers to execute arbitrary commands via the k parameter. Documents consistently describe an authentication bypass in Hawt.io’s admin terminal, enabling command execution with potential high impa...

CVE-2013-4372

CVE-2013-4372: Stored XSS in the Fuse Management Console of Red Hat JBoss Fuse 6.0.0 before patch 3 and JBoss A-MQ 6.0.0 before patch 3, exploitable via the user field on the create user page or the profile version on the create profile page. This can allow remote attackers to inject arbitrary we...

CVE-2016-8653

CVE-2016-8653 affects Red Hat JBoss Fuse 6 and Red Hat A-MQ 6. The issue resides in the JMX endpoint, which deserializes credentials passed to it, enabling a potential denial of service attack. Public sources in the connected documents confirm the products and root cause as described, with no exp...

CVE-2014-8175

The CVE-2014-8175 entry affects Red Hat JBoss Fuse

CVE-2014-0120

CVE-2014-0120 is a CSRF vulnerability in Hawt.io’s admin terminal that enables a remote attacker to hijack the user’s authenticated session and issue commands on the Karaf server (examples include shutdown -f). Multiple connected sources describe Hawt.io admin terminal CSRF and the potential to e...