Redhat: >> Jboss Enterprise Web Server Security Vulnerabilities
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
CVSS Score
7.5
EPSS Score
0.02
Published
2021-05-28
EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation.
CVSS Score
7.5
EPSS Score
0.002
Published
2020-01-23
cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.
CVSS Score
7.5
EPSS Score
0.002
Published
2019-12-19
eDeploy has RCE via cPickle deserialization of untrusted data
CVSS Score
9.8
EPSS Score
0.01
Published
2019-12-15
eDeploy has tmp file race condition flaws
CVSS Score
8.1
EPSS Score
0.005
Published
2019-12-15
An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies
CVSS Score
3.3
EPSS Score
0.001
Published
2019-12-06
eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data
CVSS Score
9.8
EPSS Score
0.031
Published
2019-11-21
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
CVSS Score
4.3
EPSS Score
0.002
Published
2019-11-13
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVSS Score
9.8
EPSS Score
0.895
Published
2019-11-01
If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer, then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable "non-stitched" ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).
CVSS Score
5.9
EPSS Score
0.044
Published
2019-02-27
Page 1