redhat wildfly - vulnerabilities and exploits

(subscribe to this query)

7.1

CVSSv2

A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application uses the OpenTracing API's java-interceptors, there is a possibility of a memory leak. This flaw allows an malicious user to impact th...

Redhat Wildfly 19.0.0 Redhat Wildfly 19.1.0 Redhat Wildfly 20.0.0 Redhat Wildfly 20.0.1 Redhat Wildfly 21.0.0

NA

A flaw was found in wildfly-core in all versions. If a vault expression is in the form of a single attribute that contains multiple expressions, a user who was granted access to the management interface can potentially access a vault expression they should not be able to access a...

Redhat Descision Manager 7.0 Redhat Wildfly 16.0.0 Redhat Wildfly 17.0.0

5

CVSSv2

Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow keeps a cache of seen HTTP headers in persistent connections. It was found that this cache can easily exploited to fill memory with garbage, u...

Redhat Jboss Wildfly Application Server 11.0.0 Redhat Jboss Wildfly Application Server

6.4

CVSSv2

A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potent...

Redhat Jboss Data Grid 7.0.0 Redhat Jboss Enterprise Application Platform 7.0.0 Redhat Jboss Fuse 7.0.0 Redhat Openshift Application Runtimes -Redhat Single Sign-on 7.0 Redhat Wildfly 7.2.0 Redhat Wildfly 7.2.3 Redhat Wildfly 7.2.5

4

CVSSv2

A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability is to the confidentiality.

Redhat Wildfly

3.5

CVSSv2

A flaw exists in WildFly prior to 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.

Redhat Wildfly

4.3

CVSSv2

The IIOP OpenJDK Subsystem in WildFly before version 14.0.0 does not honour configuration when SSL transport is required. Servers before this version that are configured with the following setting allow clients to create plaintext connections: <transport-config confidentiality...

Redhat Wildfly

6

CVSSv2

A vulnerability was found in Wildfly in versions prior to 20.0.0.Final, where a remote deserialization attack is possible in the Enterprise Application Beans(EJB) due to lack of validation/filtering capabilities in wildfly.

Redhat Wildfly

5.5

CVSSv2

A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final are affected.

Redhat Wildfly

7.5

CVSSv2

An issue exists in WildFly 10.1.2.Final. In the case of a default installation without a security realm reference, an attacker can successfully access the server without authentication. NOTE: the Security Realms documentation in the product's Admin Guide indicates that "...

Redhat Wildfly 10.1.2

Get Started

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook