Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

redhat build of quarkus vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2023-48795
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH prior to 9.6 and other products, allows remote malicious users to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may conseque...
Openbsd OpensshPutty PuttyFilezilla-project Filezilla ClientMicrosoft PowershellPanic Transmit 5Panic NovaRoumenpetrov PkixsshWinscp WinscpBitvise Ssh ClientBitvise Ssh ServerLancom-systems LcosLancom-systems Lcos Fx -Lancom-systems Lcos Lx -Lancom-systems Lcos Sx 5.20Lancom-systems Lcos Sx 4.20Lancom-systems Lanconfig -Vandyke SecurecrtLibssh LibsshNet-ssh Net-ssh 7.2.0Ssh2 Project Ssh2Proftpd ProftpdFreebsd Freebsd
NA
CVE-2023-6394
A flaw was found in Quarkus. This issue occurs when receiving a request over websocket with no role-based permission specified on the GraphQL operation, Quarkus processes the request without authentication despite the endpoint being secured. This can allow an malicious user to ac...
Quarkus QuarkusRedhat Build Of Quarkus -
NA
CVE-2023-6393
A flaw was found in the Quarkus Cache Runtime. When request processing utilizes a Uni cached using @CacheResult and the cached Uni reuses the initial "completion" context, the processing switches to the cached Uni instead of the request context. This is a problem if the...
Redhat Build Of Quarkus -
NA
CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Ietf Http 2.0Nghttp2 Nghttp2Netty NettyEnvoyproxy Envoy 1.27.0Envoyproxy Envoy 1.26.4Envoyproxy Envoy 1.25.9Envoyproxy Envoy 1.24.10Eclipse JettyCaddyserver CaddyGolang Http2Golang GoGolang NetworkingF5 Big-ip AnalyticsF5 Big-ip Policy Enforcement ManagerF5 Big-ip Local Traffic ManagerF5 Big-ip Link ControllerF5 Big-ip Global Traffic ManagerF5 Big-ip Fraud Protection ServiceF5 Big-ip Domain Name SystemF5 Big-ip Application Security ManagerF5 Big-ip Application Acceleration ManagerF5 Big-ip Advanced Firewall Manager
NA
CVE-2023-4853
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an malicious user to bypass the security policy altogether, resul...
Quarkus QuarkusRedhat Decision Manager 7.0Redhat Jboss Middleware Text-only Advisories 1.0Redhat Jboss Middleware 1Redhat Integration Service Registry -Redhat Integration Camel Quarkus -Redhat Build Of QuarkusRedhat Openshift Serverless -Redhat Integration Camel KRedhat Process Automation Manager 7.0Redhat Build Of Optaplanner 8.0Redhat Openshift Serverless 1.0Redhat Openshift Container Platform 4.10Redhat Openshift Container Platform 4.11Redhat Openshift Container Platform 4.12
NA
CVE-2023-1108
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
Redhat Decision Manager 7.0Redhat Single Sign-on -Redhat Process Automation 7.0Redhat Openstack Platform 13.0Redhat Jboss Enterprise Application Platform -Redhat Openshift Application Runtimes -Redhat Build Of Quarkus -Redhat Integration Service Registry -Redhat Integration Camel K -Redhat Jboss Enterprise Application Platform Expansion Pack -Redhat Fuse 1.0.0Redhat UndertowRedhat Openshift Container Platform 4.11Redhat Openshift Container Platform 4.12Redhat Openshift Container Platform For Linuxone 4.9Redhat Openshift Container Platform For Linuxone 4.10Redhat Openshift Container Platform For Power 4.9Redhat Openshift Container Platform For Power 4.10Redhat Jboss Enterprise Application Platform 7.4Redhat Single Sign-on 7.6Netapp Oncommand Workflow Automation -
NA
CVE-2023-2974
A vulnerability was found in quarkus-core. This vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, and the client can force the selection of the weaker supported TLS protocol.
Redhat Build Of Quarkus
NA
CVE-2023-1664
A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be v...
Redhat Keycloak -Redhat Single Sign-on 7.0Redhat Build Of Quarkus -Redhat Jboss A-mq 7Redhat Migration Toolkit For Runtimes -
NA
CVE-2022-4492
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.
Redhat Jboss Enterprise Application Platform 7.0.0Redhat Single Sign-on 7.0Redhat Jboss Fuse 7.0.0Redhat Build Of Quarkus -Redhat Integration Service Registry -Redhat Integration Camel K -Redhat Undertow 2.7.0Redhat Integration Camel For Spring Boot -Redhat Migration Toolkit For Applications 6.0Redhat Migration Toolkit For Runtimes -
NA
CVE-2023-0044
If the Quarkus Form Authentication session cookie Path attribute is set to `/` then a cross-site attack may be initiated which might lead to the Information Disclosure. This attack can be prevented with the Quarkus CSRF Prevention feature.
Quarkus QuarkusRedhat Build Of Quarkus -
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-38002CVE-2006-4304CVE-2024-4336CVE-2024-33437CVE-2024-4340CVE-2024-27956privilegeinsecure direct object referenceXSSitem search icon">CVE-2024-25938
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook