JE
Product
Jboss Enterprise Application Platform
On CISA KEVExploited in the wildRansomware-linked
241
CVEs
5
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 36High 76Medium 60Low 1
Watch
Add Jboss Enterprise Application Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-9513 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service Affected: 7.2.0; 7.3.0 |
| CVE-2019-9511 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service Affected: 7.2.0; 7.3.0 |
| CVE-2019-10184 | 7.5 | Jul 25 | undertow before version 2.0.23.Final is vulnerable to an information leak issue Affected: 7.0.0; 7.2; 7.3; 7.4; 7.2; 7.3; +3 more |
| CVE-2018-12022 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 7.2.0 |
| CVE-2018-12023 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 7.2.0 |
| CVE-2018-1000632 | 7.5 | Aug 20 | dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element Affected: 6.0.0; 6.4.0; 7.1.0; 6.0.0; 6.4.0 |
| CVE-2018-1336 | 7.5 | Aug 2 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service Affected: 6.0.0; 6.4.0 |
| CVE-2017-2670 | 7.5 | Jul 27 | It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS Affected: 6.0.0; 7.0.0; 7.1.0 |
| CVE-2017-12165 | 7.5 | Jul 27 | It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling Affected: 7.0.0; 7.1.0 |
| CVE-2018-1000180 | 7.5 | Jun 5 | Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in… Affected: 7.1.0 |
| CVE-2017-12174 | 7.5 | Mar 7 | It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast… Affected: 6.4.0; 7.1.0; 7.1.0; 6.0.0; 6.4.0 |
| CVE-2018-1041 | 7.5 | Feb 15 | A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer Affected: 6.0.0; 6.4.0 |
| CVE-2018-1048 | 7.5 | Jan 24 | It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters… Affected: 7.1.0 |
| CVE-2016-8610 | 7.5 | Nov 13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection… Affected: 6.0.0; 6.4.0 |
| CVE-2017-7561 | 7.5 | Sep 13 | Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact Affected: 3.0.7; 3.0.8; 3.1.0; 3.1.1; 3.1.2; 3.1.4; +8 more |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 6.4 |
| CVE-2016-3110 | 7.5 | Sep 26 | mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of =… Affected: 6.0.0; 6.4.0 |
| CVE-2016-2183 | 7.5 | Sep 1 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which… Affected: 6.0.0 |
| CVE-2022-3143 | 7.4 | Jan 13 | wildfly-elytron: possible timing attacks via use of unsafe comparator Affected: 7.0.0 |
| CVE-2014-0224 | 7.4 | Jun 5 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers… Affected: 5.2.0; 6.2.3 |
| CVE-2024-10234 | 7.3 | Oct 22 | Wildfly: wildfly vulnerable to cross-site scripting (xss) Affected: 8.0 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 7.2.0 |
| CVE-2026-3121 | 7.2 | Mar 26 | Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission Affected: 8.0.0 |
| CVE-2021-20318 | 7.2 | Dec 23 | The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978 Affected: 7.3.9; 7.4.0 |
| CVE-2016-4978 | 7.2 | Sep 27 | The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0… Affected: 6.0.0; 6.4.0; 7.0.0; 7.1.0 |
| CVE-2017-7536 | 7.0 | Jan 10 | In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private… Affected: 6.0.0; 6.4.0; 7.0; 7.1 |