redhat jboss enterprise application platform 7.2.6 vulnerabilities and exploits

(subscribe to this query)

4

CVSSv2

A flaw was found in the JBoss EAP Vault system in all versions prior to 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the...

Redhat Single Sign-on 7.0 Redhat Jboss Enterprise Application Platform 7.2.6 Redhat Jboss Enterprise Application Platform

5

CVSSv2

A vulnerability was found in the Undertow HTTP server in versions prior to 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

Redhat Undertow Redhat Jboss Data Grid -Redhat Jboss Data Grid 7.0.0 Redhat Jboss Enterprise Application Platform 7.0.0 Redhat Jboss Fuse 6.0.0 Redhat Jboss Fuse 7.0.0 Redhat Single Sign-on 7.0 Netapp Active Iq Unified Manager -

7.5

CVSSv2

A flaw exists in jackson-databind in versions prior to 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

Fasterxml Jackson-databind Redhat Jboss Enterprise Application Platform 7.0 Redhat Decision Manager 7.0 Redhat Jboss Fuse 7.0.0 Redhat Process Automation 7.0 Redhat Jboss Data Grid 7.0.0 Redhat Openshift Container Platform 4.3 Redhat Jboss Data Grid -Apache Geode 1.12.0

1 Github repository

3.5

CVSSv2

A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions prior to 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.

Redhat Jboss Enterprise Application Platform 7.0 Redhat Jboss Enterprise Application Platform 7.1.0 Redhat Single Sign-on 7.2

5

CVSSv2

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.

Redhat Undertow -Redhat Jboss Enterprise Application Platform 7.1 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3

5

CVSSv2

dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specify...

5

CVSSv2

Netty prior to 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

Netty Netty Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Canonical Ubuntu Linux 18.04 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4

6.8

CVSSv2

A Polymorphic Typing issue exists in FasterXML jackson-databind 2.0.0 up to and including 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in ...

2 Github repositories

7.5

CVSSv2

A Polymorphic Typing issue exists in FasterXML jackson-databind prior to 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

1 Github repository

7.5

CVSSv2

A Polymorphic Typing issue exists in FasterXML jackson-databind prior to 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Fasterxml Jackson-databind Netapp Steelstore Cloud Integrated Storage -Netapp Oncommand Workflow Automation -Netapp Service Level Manager -Netapp Oncommand Api Services -Netapp Active Iq Unified Manager Debian Debian Linux 8.0 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Oracle Weblogic Server 12.2.1.3.0 Oracle Retail Customer Management And Segmentation Foundation 17.0 Oracle Goldengate Application Adapters 19.1.0.0.0 Oracle Customer Management And Segmentation Foundation

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook