redhat jboss enterprise application platform 7.2 vulnerabilities and exploits

(subscribe to this query)

An information leak vulnerability was found in Undertow. If all headers are not written out in the first write() call then the code that handles flushing the buffer will always write out the full contents of the writevBuffer buffer, which may contain data from previous requests.

Redhat Undertow -Redhat Jboss Enterprise Application Platform 7.1 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3

A flaw exists in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an malicious user to poison a web-cache, ...

Redhat Undertow Redhat Jboss Enterprise Application Platform -Redhat Single Sign-on -Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4

A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions prior to 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users.

Redhat Jboss Enterprise Application Platform 7.0 Redhat Jboss Enterprise Application Platform 7.1.0 Redhat Single Sign-on 7.2

A flaw exists in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.

Redhat Undertow Netapp Oncommand Insight -Redhat Jboss Enterprise Application Platform -Redhat Openshift Application Runtimes -Redhat Jboss Enterprise Application Platform 7.2

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

Redhat Undertow Redhat Jboss Data Grid Redhat Jboss Data Grid -Redhat Jboss Enterprise Application Platform -Redhat Jboss Fuse Redhat Openshift Application Runtimes -Redhat Single Sign-on Netapp Active Iq Unified Manager -Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.

Redhat Undertow Redhat Jboss Data Grid -Redhat Jboss Enterprise Application Platform -Redhat Jboss Enterprise Application Platform 7.0.0 Redhat Openshift Application Runtimes -Redhat Openshift Application Runtimes 1.0 Redhat Single Sign-on -Redhat Single Sign-on 7.0 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4 Redhat Single Sign-on 7.3

A flaw was found in Undertow in versions prior to 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an malicious user to take advantage of HTTP request smuggling.

Redhat Undertow Netapp Oncommand Insight Redhat Fuse 1.0 Redhat Jboss Enterprise Application Platform -Redhat Openshift Application Runtimes -Redhat Single Sign-on -Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4 Redhat Jboss Enterprise Application Platform 7.2 Netapp Active Iq Unified Manager -Netapp Oncommand Workflow Automation -

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious be...

Infinispan Infinispan Redhat Fuse 1.0 Redhat Jboss Data Grid -Redhat Jboss Enterprise Application Platform -Redhat Openshift Application Runtimes -Redhat Single Sign-on -Redhat Jboss Enterprise Application Platform 7.2 Netapp Active Iq Unified Manager -

Netty 4.1.43.Final allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a [space]Transfer-Encoding:chunked line) and a later Content-Length header. This issue exists because of an incomplete fix for CVE-2019-16869.

Netty Netty 4.1.43 Fedoraproject Fedora 33 Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4 Redhat Jboss Enterprise Application Platform Text-only Advisories -Redhat Openshift Application Runtimes Text-only Advisories -

Netty prior to 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

Netty Netty Debian Debian Linux 8.0 Debian Debian Linux 9.0 Debian Debian Linux 10.0 Canonical Ubuntu Linux 18.04 Redhat Jboss Enterprise Application Platform 7.2 Redhat Jboss Enterprise Application Platform 7.3 Redhat Jboss Enterprise Application Platform 7.4

1 2 3 4 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Product List Vendor List Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook