redhat jboss enterprise application platform 7.2 vulnerabilities and exploits

(subscribe to this query)

9.8

CVSSv3

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web applicati...

Redhat Undertow

9.8

CVSSv3

A Polymorphic Typing issue exists in FasterXML jackson-databind 2.0.0 up to and including 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in ...

2 Github repositories

9.8

CVSSv3

A Polymorphic Typing issue exists in FasterXML jackson-databind prior to 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Fasterxml Jackson-databind Netapp Steelstore Cloud Integrated Storage -Netapp Oncommand Workflow Automation -Netapp Service Level Manager -Netapp Oncommand Api Services -Netapp Active Iq Unified Manager Debian Debian Linux 8.0 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Oracle Weblogic Server 12.2.1.3.0 Oracle Retail Customer Management And Segmentation Foundation 17.0 Oracle Goldengate Application Adapters 19.1.0.0.0 Oracle Customer Management And Segmentation Foundation

9.8

CVSSv3

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

Redhat Undertow Redhat Jboss Data Grid -Redhat Jboss Data Grid Redhat Jboss Enterprise Application Platform -Redhat Jboss Fuse Redhat Openshift Application Runtimes -Redhat Single Sign-on Netapp Active Iq Unified Manager -Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4

9.8

CVSSv3

A Polymorphic Typing issue exists in FasterXML jackson-databind 2.0.0 up to and including 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an...

9.8

CVSSv3

A Polymorphic Typing issue exists in FasterXML jackson-databind prior to 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

2 Github repositories

9.8

CVSSv3

A Polymorphic Typing issue exists in FasterXML jackson-databind prior to 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

1 Github repository

9.8

CVSSv3

SubTypeValidator.java in FasterXML jackson-databind prior to 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

1 Github repository

9.1

CVSSv3

HttpObjectDecoder.java in Netty prior to 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Netty Netty Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 33 Canonical Ubuntu Linux 18.04 Redhat Jboss Amq Clients 2 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3

9.1

CVSSv3

HttpObjectDecoder.java in Netty prior to 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

Netty Netty Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Fedoraproject Fedora 33 Canonical Ubuntu Linux 18.04 Redhat Jboss Amq Clients 2 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Apache Spark 2.4.7 Apache Spark 2.4.8

Get Started

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook