JE
Product
Jboss Enterprise Application Platform
On CISA KEVExploited in the wildRansomware-linked
241
CVEs
5
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 36High 76Medium 60Low 1
Watch
Add Jboss Enterprise Application Platform to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-0738 RansomwareIn wildKEV | 5.3 | Apr 28 | Red Hat JBoss Authentication Bypass Vulnerability Affected: 4.2.0; 4.3.0 |
| CVE-2025-23367 | 6.5 | Jan 30 | Org.wildfly.core:wildfly-server: wildfly improper rbac permission Affected: 7.4 before 7.4.21; 8.0.0 before 8.0.7 |
| CVE-2024-1102 | 6.5 | Apr 25 | Jberet: jberet-core logging database credentials Affected: 8.0 |
| CVE-2023-3629 | 6.5 | Dec 18 | A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation Affected: 6 |
| CVE-2023-3628 | 6.5 | Dec 18 | A flaw was found in Infinispan's REST Affected: 6 |
| CVE-2023-4061 | 6.5 | Nov 8 | A flaw was found in wildfly-core Affected: 7.4 |
| CVE-2021-32029 | 6.5 | Oct 8 | A flaw was found in postgresql Affected: 7.0.0 |
| CVE-2020-25689 | 6.5 | Nov 2 | A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly… Affected: 7.0.0 |
| CVE-2020-14299 | 6.5 | Oct 16 | A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded… Affected: before 5.0.3 |
| CVE-2019-14900 | 6.5 | Jul 6 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1 Affected: 7.3; 7.4; 7.3; 7.4; 7.3; 7.2; +2 more |
| CVE-2020-10719 | 6.5 | May 26 | A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes Affected: 7.3; 7.4; 7.3; 7.4; 7.3; 7.2; +2 more |
| CVE-2014-0169 | 6.5 | Jan 2 | In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain Affected: 6.0.0 |
| CVE-2019-9516 | 6.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service Affected: 7.2.0; 7.3.0 |
| CVE-2016-7061 | 6.5 | Sep 10 | An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4 Affected: before 7.0.4 |
| CVE-2017-2595 | 6.5 | Jul 27 | It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal Affected: 6.0.0; 6.4.0; 7.0.0; 7.1.0 |
| CVE-2017-2666 | 6.5 | Jul 27 | It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters Affected: 7.0.0; 7.1.0; 7.0.0; 7.1.0 |
| CVE-2017-2582 | 6.5 | Jul 26 | It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property Affected: 6.0.0; 6.4.0; 7.0.0; 7.1.0 |
| CVE-2016-8627 | 6.5 | May 11 | admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them… Affected: 6.4.0; 7.0.0; 7.1.0 |
| CVE-2012-4549 | 6.5 | Jan 5 | A flaw was found in JBoss Enterprise Application Platform Affected: through 6.0.0; 4.2.0; 4.3.0; 5.0.0; 5.0.1; 5.1.0; +5 more |
| CVE-2023-1932 | 6.1 | Nov 7 | Hibernate-validator: rendering of invalid html with safehtml leads to html injection and xss Affected: 7.0.0 |
| CVE-2020-10688 | 6.1 | May 27 | A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the… Affected: 7.3; 7.4 |
| CVE-2013-6495 | 6.1 | Dec 11 | JBossWeb Bayeux has reflected XSS Affected: 6.0.0 before 6.1.1 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: 7.2; 7.3 |
| CVE-2018-1067 | 6.1 | May 21 | In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP… Affected: 7.1 |
| CVE-2016-4993 | 6.1 | Sep 26 | CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers… Affected: through 7.0.1 |
| CVE-2023-48795 | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: 7.0 |
| CVE-2021-3629 | 5.9 | May 24 | A flaw was found in Undertow Affected: 7.4; 7.3 |
| CVE-2021-3597 | 5.9 | May 24 | A flaw was found in undertow Affected: 7.3; 7.4 |
| CVE-2020-14340 | 5.9 | Jun 2 | A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles Affected: 5.0.0; 6.0.0 |
| CVE-2011-2487 | 5.9 | Mar 11 | The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack Affected: 5.0.0 |
| CVE-2018-10237 | 5.9 | Apr 26 | Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this… Affected: 6.0.0; 6.4.0; 7.1.0; 6.0.0; 6.4.0; 6.0.0; +2 more |
| CVE-2017-12196 | 5.9 | Apr 18 | undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the… Affected: 7.0.0 |
| CVE-2018-1304 | 5.9 | Feb 28 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49… Affected: 6; 6.4 |
| CVE-2015-1849 | 5.9 | Sep 19 | AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP… Affected: through 6.4.0 |
| CVE-2016-7046 | 5.9 | Oct 3 | Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial of service (CPU and… Affected: 7.0 |
| CVE-2026-4366 | 5.8 | Mar 18 | Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak Affected: 8.0.0 |
| CVE-2025-5731 | 5.5 | Jun 26 | Infinispan: credential leakage in infinispan cli Affected: 7.0.0; 8.0.0 |
| CVE-2020-14317 | 5.5 | Jun 2 | It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - Continuous Delivery (EAP-CD) introducing… Affected: All versions, or not specified |
| CVE-2019-12400 | 5.5 | Aug 23 | In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders Affected: 7.2 |
| CVE-2018-10862 | 5.5 | Jul 27 | WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files Affected: 7.1.0; 7.1.0 |
| CVE-2017-12167 | 5.5 | Jul 26 | It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuration that contain user to role mapping are world readable… Affected: before 7.0.9; 7.1.0; 7.0.0 |
| CVE-2018-1047 | 5.5 | Jan 24 | A flaw was found in Wildfly 9.x Affected: 7.1.0 |
| CVE-2019-3872 | 5.4 | Jun 12 | It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x Affected: 7.2.0 |
| CVE-2018-10934 | 5.4 | Mar 27 | A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA Affected: 7.0; 7.1.0 |
| CVE-2022-0866 | 5.3 | May 10 | This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal Affected: 7.1.0 and later |
| CVE-2021-3642 | 5.3 | Aug 5 | A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if… Affected: 7.0.0 |
| CVE-2020-1710 | 5.3 | Sep 16 | The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400 Affected: 6.4.21; 7.0.0; 7.2.0; 7.3.0 |
| CVE-2020-10693 | 5.3 | May 6 | A flaw was found in Hibernate Validator version 6.1.2.Final Affected: 7.2.0; 7.3.0 |
| CVE-2018-14642 | 5.3 | Sep 18 | An information leak vulnerability was found in Undertow Affected: 7.1; 7.2; 7.3 |
| CVE-2016-9585 | 5.3 | Mar 9 | Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it Affected: 5.0.0 |