Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

jboss enterprise application platform vulnerabilities and exploits

(subscribe to this query)
4.6
CVSSv2
CVE-2012-1167
The JBoss Server in JBoss Enterprise Application Platform 5.1.x prior to 5.1.2 and 5.2.x prior to 5.2.2, Web Platform prior to 5.1.2, BRMS Platform prior to 5.3.0, and SOA Platform prior to 5.3.0, when the server is configured to use the JaccAuthorizationRealm and the ignoreBaseD...
Redhat Jboss Enterprise Application Platform 5.1.1Redhat Jboss Enterprise Application Platform 5.1.0Redhat Jboss Enterprise Application Platform 5.2.0Redhat Jboss Enterprise Application Platform 5.2.1Redhat Jboss Enterprise Soa Platform 5.1.0Redhat Jboss Enterprise Soa Platform 5.0.2Redhat Jboss Enterprise Soa Platform 5.0.1Redhat Jboss Enterprise Soa PlatformRedhat Jboss Enterprise Soa Platform 5.1.1Redhat Jboss Enterprise Web Platform 5.1.0Redhat Jboss Enterprise Brms PlatformRedhat Jboss Enterprise Web PlatformRedhat Jboss Enterprise Soa Platform 5.0.0
4.3
CVSSv2
CVE-2008-3519
The default configuration of the JBossAs component in Red Hat JBoss Enterprise Application Platform (aka JBossEAP or EAP), possibly 4.2 before CP04 and 4.3 before CP02, when a production environment is enabled, sets the DownloadServerClasses property to true, which allows remote ...
Redhat Jboss Enterprise Application Platform 4.2Redhat Jboss Enterprise Application PlatformRedhat Jboss Enterprise Application Platform 4.3
7.5
CVSSv2
CVE-2012-5629
The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP) 5.2.0 allow remote malicious users to bypass authentication via an empty password...
Redhat Jboss Enterprise Web Platform 5.2.0Redhat Jboss Enterprise Application Platform 6.0.1Redhat Jboss Enterprise Application Platform 4.3.0Redhat Jboss Enterprise Application Platform 5.2.0
2.1
CVSSv2
CVE-2009-3554
Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 prior to 4.2.0.CP08 and 4.3 prior to 4.3.0.CP07 writes the JMX password, and other command-line arguments, to the twiddle.log file, which allows local users to obtain sensitive information by re...
Redhat Jboss Enterprise Application Platform 4.2Redhat Jboss Enterprise Application Platform 4.2.0Redhat Jboss Enterprise Application Platform 4.2.2
5
CVSSv2
CVE-2020-1710
The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
Redhat Jboss Data Grid -Redhat Jboss Data Grid 7.0.0Redhat Jboss Enterprise Application Platform -Redhat Jboss Enterprise Application Platform 6.4.21Redhat Jboss Enterprise Application Platform 7.0.0Redhat Jboss Enterprise Application Platform 7.2.0Redhat Jboss Enterprise Application Platform 7.3.0Redhat Openshift Application Runtimes -Redhat Single Sign-on -
2.1
CVSSv2
CVE-2012-0034
The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform prior to 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensiti...
Redhat Jboss Enterprise Application Platform 5.1.2Redhat Jboss Enterprise Application Platform 5.2.0Redhat Jboss Enterprise Web Platform 5.2.0Redhat Jboss Enterprise Web Platform 5.1.2Redhat Jboss Enterprise Brms Platform
2.1
CVSSv2
CVE-2013-0218
The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows local users to obtain the administrator password and the sucker password by read...
Redhat Jboss Enterprise Application Platform 5.2.0Redhat Jboss Enterprise Application Platform 5.1.2Redhat Jboss Enterprise Web Platform 5.1.2Redhat Jboss Enterprise Web Platform 5.2.0
7.5
CVSSv2
CVE-2011-4605
The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform 4.3 CP07 and 5.2.x prior to 5.2.2, and BRMS Platform prior t...
Redhat Jboss Enterprise Application Platform 4.3.0Redhat Jboss Enterprise Application Platform 5.1.2Redhat Jboss Enterprise Web Platform 5.1.2Redhat Jboss Enterprise Portal Platform 5.2.1Redhat Jboss Enterprise Portal Platform 4.3.0Redhat Jboss Enterprise Brms PlatformRedhat Jboss Enterprise Soa Platform 4.2.0Redhat Jboss Enterprise Portal Platform 5.2.0Redhat Jboss Enterprise Soa Platform 4.3.0
5.5
CVSSv2
CVE-2014-3464
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restric...
Redhat Jboss Enterprise Application Platform 6.3.0Redhat Jboss Enterprise Application Platform 6.2.0
5
CVSSv2
CVE-2009-0027
The request handler in JBossWS in JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 prior to 4.2.0.CP06 and 4.3 prior to 4.3.0.CP04 does not properly validate the resource path during a request for a WSDL file with a custom web-service endpoint, which allows remo...
Redhat Jboss Enterprise Application Platform 4.3.0Redhat Jboss Enterprise Application Platform 4.2.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
injectionCVE-2024-30983CVE-2023-4235CVE-2024-21338privilegeencryptionCVE-2023-4232CVE-2024-31497CVE-2024-32341
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook