Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

redhat jboss a-mq 7 vulnerabilities and exploits

(subscribe to this query)
7.5
CVSSv3
CVE-2023-44487
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
Ietf Http 2.0Nghttp2 Nghttp2Netty NettyEnvoyproxy Envoy 1.27.0Envoyproxy Envoy 1.26.4Envoyproxy Envoy 1.25.9Envoyproxy Envoy 1.24.10Eclipse JettyCaddyserver CaddyGolang Http2Golang GoGolang NetworkingF5 Big-ip AnalyticsF5 Big-ip Policy Enforcement ManagerF5 Big-ip Local Traffic ManagerF5 Big-ip Link ControllerF5 Big-ip Global Traffic ManagerF5 Big-ip Fraud Protection ServiceF5 Big-ip Domain Name SystemF5 Big-ip Application Security ManagerF5 Big-ip Application Acceleration ManagerF5 Big-ip Advanced Firewall Manager
5.5
CVSSv3
CVE-2023-4066
A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.
Redhat Jboss Middleware 1Redhat Jboss A-mq 7Redhat Openshift Container Platform 4.11Redhat Openshift Container Platform 4.12
5.5
CVSSv3
CVE-2023-4065
A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local malicious user to access information outside of their permissions.
Redhat Jboss Middleware 1Redhat Jboss A-mq 7Redhat Openshift Container Platform 4.11Redhat Openshift Container Platform 4.12
6.5
CVSSv3
CVE-2023-1664
A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not validating the certificate before Keycloak. Using this method an attacker may choose the certificate which will be v...
Redhat Keycloak -Redhat Single Sign-on 7.0Redhat Build Of Quarkus -Redhat Jboss A-mq 7Redhat Migration Toolkit For Runtimes -
7.5
CVSSv3
CVE-2022-1278
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
Redhat WildflyRedhat Single Sign-on 7.0Redhat Amq 2.0Redhat Integration Service Registry -Redhat Integration Camel K -Redhat Jboss A-mq 7Redhat Jboss Enterprise Application Platform Expansion Pack -Redhat Amq Online -
5.6
CVSSv3
CVE-2020-14379
A flaw was found in Red Hat AMQ Broker in a way that a XEE attack can be done via Broker's configuration files, leading to denial of service and information disclosure.
Redhat Jboss A-mq 7
7.5
CVSSv3
CVE-2021-4104
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests t...
Apache Log4j 1.2Fedoraproject Fedora 35Redhat Jboss Operations Network 3.0Redhat Jboss A-mq 6.0.0Redhat Enterprise Linux 7.0Redhat Enterprise Linux 6.0Redhat Jboss Enterprise Application Platform 6.0.0Redhat Jboss Enterprise Application Platform 7.0Redhat Jboss Fuse 6.0.0Redhat Jboss Fuse Service Works 6.0Redhat Jboss Web Server 3.0Redhat Jboss Data Virtualization 6.0.0Redhat Enterprise Linux 8.0Redhat Single Sign-on 7.0Redhat Software Collections -Redhat Jboss Fuse 7.0.0Redhat Process Automation 7.0Redhat Jboss Data Grid 7.0.0Redhat Openshift Application Runtimes -Redhat Codeready Studio 12.0Redhat Integration Camel K -Redhat Openshift Container Platform 4.6
4.4
CVSSv3
CVE-2021-3425
A flaw was found in the AMQ Broker that discloses JDBC encrypted usernames and passwords when provided in the AMQ Broker application logfile when using the jdbc persistence functionality. Versions shipped in Red Hat AMQ 7 are vulnerable.
Redhat Jboss A-mq 7
4.8
CVSSv3
CVE-2021-3536
A flaw was found in Wildfly in versions prior to 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.
Redhat Build Of Quarkus -Redhat Data Grid 8.0Redhat Descision Manager 7.0Redhat Integration Camel K -Redhat Integration Camel Quarkus -Redhat Integration Service Registry -Redhat Jboss A-mq 7Redhat Jboss Enterprise Application Platform 7.0Redhat Wildfly
7.3
CVSSv3
CVE-2019-10086
In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an malicious user to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of th...
Apache Commons BeanutilsApache Nifi 1.14.0Apache Nifi 1.15.0Debian Debian Linux 8.0Opensuse Leap 15.0Opensuse Leap 15.1Fedoraproject Fedora 30Fedoraproject Fedora 31Redhat Enterprise Linux Desktop 7.0Redhat Enterprise Linux Workstation 7.0Redhat Enterprise Linux Server 7.0Redhat Enterprise Linux Server Aus 7.7Redhat Enterprise Linux Server Tus 7.7Redhat Enterprise Linux Eus 7.7Redhat Jboss Enterprise Application Platform 7.2.0Oracle Retail Xstore Point Of Service 15.0Oracle Flexcube Private Banking 12.1.0Oracle Banking Platform 2.4.0Oracle Retail Xstore Point Of Service 7.1Oracle Flexcube Private Banking 12.0.0Oracle Service Bus 11.1.1.9.0Oracle Fusion Middleware 11.1.1.9
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2006-4304CVE-2024-4240arbitrary CVE-2024-31601XSSCVE-2023-20198CVE-2024-4256CVE-2024-3342encryption
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook