redhat jboss enterprise application platform 7.2.0 vulnerabilities and exploits

(subscribe to this query)

10

CVSSv3

FasterXML jackson-databind 2.x prior to 2.9.7 might allow remote malicious users to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Fasterxml Jackson-databind 2.7.0 Fasterxml Jackson-databind Fasterxml Jackson-databind 2.8.0 Fasterxml Jackson-databind 2.9.0 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Oracle Primavera Unifier 16.2 Oracle Banking Platform 2.5.0 Oracle Primavera Unifier 16.1 Oracle Jdeveloper 12.1.3.0.0 Oracle Retail Merchandising System 16.0 Oracle Webcenter Portal 12.2.1.3.0 Oracle Primavera Unifier Oracle Communications Billing And Revenue Management 7.5 Oracle Communications Billing And Revenue Management 12.0 Oracle Financial Services Analytical Applications Infrastructure 8.0.2 Oracle Financial Services Analytical Applications Infrastructure 8.0.3 Oracle Financial Services Analytical Applications Infrastructure 8.0.4 Oracle Financial Services Analytical Applications Infrastructure 8.0.5 Oracle Financial Services Analytical Applications Infrastructure 8.0.6 Oracle Financial Services Analytical Applications Infrastructure 8.0.7 Oracle Banking Platform 2.6.0

9.8

CVSSv3

A Polymorphic Typing issue exists in FasterXML jackson-databind 2.0.0 up to and including 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, a...

2 Github repositories

9.8

CVSSv3

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by impleme...

Redhat Jboss Enterprise Application Platform 7.2.0

9.8

CVSSv3

FasterXML jackson-databind 2.x prior to 2.9.7 might allow malicious users to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Fasterxml Jackson-databind 2.7.0 Fasterxml Jackson-databind Fasterxml Jackson-databind 2.8.0 Fasterxml Jackson-databind 2.9.0 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Oracle Primavera Unifier 16.2 Oracle Banking Platform 2.5.0 Oracle Primavera Unifier 16.1 Oracle Jdeveloper 12.1.3.0.0 Oracle Retail Merchandising System 16.0 Oracle Webcenter Portal 12.2.1.3.0 Oracle Primavera Unifier Oracle Communications Billing And Revenue Management 7.5 Oracle Communications Billing And Revenue Management 12.0 Oracle Financial Services Analytical Applications Infrastructure 8.0.2 Oracle Financial Services Analytical Applications Infrastructure 8.0.3 Oracle Financial Services Analytical Applications Infrastructure 8.0.4 Oracle Financial Services Analytical Applications Infrastructure 8.0.5 Oracle Financial Services Analytical Applications Infrastructure 8.0.6 Oracle Financial Services Analytical Applications Infrastructure 8.0.7 Oracle Banking Platform 2.6.0

9.1

CVSSv3

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potent...

Redhat Jboss Data Grid 7.0.0 Redhat Jboss Enterprise Application Platform 7.0.0 Redhat Jboss Fuse 7.0.0 Redhat Openshift Application Runtimes -Redhat Single Sign-on 7.0 Redhat Wildfly 7.2.0 Redhat Wildfly 7.2.3 Redhat Wildfly 7.2.5

9

CVSSv3

It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker could use this flaw to send a URL to achieve cross-site scripting or possibly conduct further attacks.

Redhat Jboss Enterprise Application Platform 7.2.0 Redhat Single Sign-on 7.0

8.8

CVSSv3

A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester. This flaw could be used by a malicious app deployed on the app server to access unauthorized information and possibly conduct further attacks. Versions shipped wit...

Redhat Single Sign-on 7.3 Redhat Jboss Enterprise Application Platform 7.2.0 Redhat Single Sign-on -

1 Github repository

7.5

CVSSv3

In Apache Thrift all versions up to and including 0.12.0, a server or client may run into an endless loop when feed with specific input data. Because the issue had already been partially fixed in version 0.11.0, depending on the installed version it affects only certain language ...

Apache Thrift Redhat Jboss Enterprise Application Platform 7.2.0 Oracle Communications Cloud Native Core Network Slice Selection Function 1.2.1

7.5

CVSSv3

In Apache Thrift 0.9.3 to 0.12.0, a server implemented in Go using TJSONProtocol or TSimpleJSONProtocol may panic when feed with invalid input data.

Apache Thrift Redhat Jboss Enterprise Application Platform 7.2.0 Oracle Communications Cloud Native Core Network Slice Selection Function 1.2.1

7.5

CVSSv3

Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. The attacker creates multiple request streams and continually shuffles the priority of the streams in a way that causes substantial churn to the priority tree. This can consu...

1 Article

Get Started

1 2 3 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook