JE
Product
Jboss Enterprise Application Platform
On CISA KEVExploited in the wildRansomware-linked
242
CVEs
5
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 37High 76Medium 60Low 1
Watch
Add Jboss Enterprise Application Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1048 | 7.5 | Jan 24 | It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters… Affected: 7.1.0 |
| CVE-2016-8610 | 7.5 | Nov 13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection… Affected: 6.0.0; 6.4.0 |
| CVE-2017-7561 | 7.5 | Sep 13 | Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact Affected: 3.0.7; 3.0.8; 3.1.0; 3.1.1; 3.1.2; 3.1.4; +8 more |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 6.4 |
| CVE-2016-3110 | 7.5 | Sep 26 | mod_cluster, as used in Red Hat JBoss Web Server 2.1, allows remote attackers to cause a denial of service (Apache http server crash) via an MCMP message containing a series of =… Affected: 6.0.0; 6.4.0 |
| CVE-2016-2183 | 7.5 | Sep 1 | The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which… Affected: 6.0.0 |
| CVE-2022-3143 | 7.4 | Jan 11 | wildfly-elytron: possible timing attacks via use of unsafe comparator Affected: 7.0.0 |
| CVE-2014-0224 | 7.4 | Jun 5 | OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers… Affected: 5.2.0; 6.2.3 |
| CVE-2024-10234 | 7.3 | Oct 22 | Wildfly: wildfly vulnerable to cross-site scripting (xss) Affected: 8.0 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 7.2.0 |
| CVE-2026-3121 | 7.2 | Mar 26 | Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission Affected: 8.0.0 |
| CVE-2021-20318 | 7.2 | Dec 23 | The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978 Affected: 7.3.9; 7.4.0 |
| CVE-2016-4978 | 7.2 | Sep 27 | The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0… Affected: 6.0.0; 6.4.0; 7.0.0; 7.1.0 |
| CVE-2017-7536 | 7.0 | Jan 10 | In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private… Affected: 6.0.0; 6.4.0; 7.0; 7.1 |
| CVE-2025-23367 | 6.5 | Jan 30 | Org.wildfly.core:wildfly-server: wildfly improper rbac permission Affected: 7.4 before 7.4.21; 8.0.0 before 8.0.7 |
| CVE-2024-1102 | 6.5 | Apr 25 | Jberet: jberet-core logging database credentials Affected: 8.0 |
| CVE-2023-3629 | 6.5 | Dec 18 | Infinispan: non-admins should not be able to get cache config via rest api Affected: 6 |
| CVE-2023-3628 | 6.5 | Dec 18 | Infispan: rest bulk ops don't check permissions Affected: 6 |
| CVE-2023-4061 | 6.5 | Nov 8 | Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor Affected: 7.4 |
| CVE-2021-32029 | 6.5 | Oct 8 | A flaw was found in postgresql Affected: 7.0.0 |
| CVE-2020-25689 | 6.5 | Nov 2 | A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly… Affected: 7.0.0 |
| CVE-2020-14299 | 6.5 | Oct 16 | A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded… Affected: before 5.0.3 |
| CVE-2019-14900 | 6.5 | Jul 6 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1 Affected: 7.3; 7.4; 7.3; 7.4; 7.3; 7.2; +2 more |
| CVE-2020-10719 | 6.5 | May 26 | A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes Affected: 7.3; 7.4; 7.3; 7.4; 7.3; 7.2; +2 more |
| CVE-2014-0169 | 6.5 | Jan 2 | In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain Affected: 6.0.0 |
| CVE-2019-9516 | 6.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service Affected: 7.2.0; 7.3.0 |
| CVE-2016-7061 | 6.5 | Sep 10 | An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4 Affected: before 7.0.4 |
| CVE-2017-2595 | 6.5 | Jul 27 | It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal Affected: 6.0.0; 6.4.0; 7.0.0; 7.1.0 |
| CVE-2017-2666 | 6.5 | Jul 27 | It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters Affected: 7.0.0; 7.1.0; 7.0.0; 7.1.0 |
| CVE-2017-2582 | 6.5 | Jul 26 | It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property Affected: 6.0.0; 6.4.0; 7.0.0; 7.1.0 |
| CVE-2016-8627 | 6.5 | May 11 | admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them… Affected: 6.4.0; 7.0.0; 7.1.0 |
| CVE-2012-4549 | 6.5 | Jan 5 | A flaw was found in JBoss Enterprise Application Platform Affected: through 6.0.0; 4.2.0; 4.3.0; 5.0.0; 5.0.1; 5.1.0; +5 more |
| CVE-2023-1932 | 6.1 | Nov 7 | Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss Affected: 7.0.0 |
| CVE-2020-10688 | 6.1 | May 27 | A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the… Affected: 7.3; 7.4 |
| CVE-2013-6495 | 6.1 | Dec 11 | JBossWeb Bayeux has reflected XSS Affected: 6.0.0 before 6.1.1 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 7.2; 7.3 |
| CVE-2018-1067 | 6.1 | May 21 | In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP… Affected: 7.1 |
| CVE-2016-4993 | 6.1 | Sep 26 | CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers… Affected: through 7.0.1 |
| CVE-2023-48795 | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: 7.0 |
| CVE-2021-3597 | 5.9 | May 24 | A flaw was found in undertow Affected: 7.3; 7.4 |
| CVE-2021-3629 | 5.9 | May 24 | A flaw was found in Undertow Affected: 7.4; 7.3 |
| CVE-2020-14340 | 5.9 | Jun 2 | A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles Affected: 5.0.0; 6.0.0 |
| CVE-2011-2487 | 5.9 | Mar 11 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack Affected: 5.0.0 |
| CVE-2018-10237 | 5.9 | Apr 26 | Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this… Affected: 6.0.0; 6.4.0; 7.1.0; 6.0.0; 6.4.0; 6.0.0; +2 more |
| CVE-2017-12196 | 5.9 | Apr 18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the… Affected: 7.0.0 |
| CVE-2018-1304 | 5.9 | Feb 28 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49… Affected: 6; 6.4 |
| CVE-2015-1849 | 5.9 | Sep 19 | AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP… Affected: through 6.4.0 |
| CVE-2016-7046 | 5.9 | Oct 3 | Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and… Affected: 7.0 |
| CVE-2026-4366 | 5.8 | Mar 18 | Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak Affected: 8.0.0 |
| CVE-2025-5731 | 5.5 | Jun 26 | Infinispan: credential leakage in infinispan cli Affected: 7.0.0; 8.0.0 |