Jboss Wildfly Application Server vulnerabilities | LiveThreat CVE Feed

Product

Jboss Wildfly Application Server

by Redhat · last CVE Mar 12, 2018

CVEs

On KEV

7.5

Max CVSS

New 30D

Vulnerabilities9 In the news0 Timeline

Severity mix

Critical 0High 3Medium 2Low 0

Severity

All severities9 Critical0 High3 Medium2 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Jboss Wildfly Application Server to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2016-9589	7.5	3%	Mar 12	Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service Affected: through 10.1.0; 11.0.0
CVE-2015-3198	7.5	2%	Jul 21	The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL Affected: 9.0.0; 9.0.0; 9.0.0
CVE-2016-0793	7.5	15%	Apr 1	Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote… Affected: 10.0.0
CVE-2016-4993	6.1	3%	Sep 26	CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers… Affected: 10.0.0
CVE-2018-1047	5.5	1%	Jan 24	A flaw was found in Wildfly 9.x Affected: 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +22 more
CVE-2015-5220	–	3%	Oct 27	The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service… Affected: through 2.0.0
CVE-2015-5188	–	1%	Oct 27	Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application… Affected: through 2.0.0
CVE-2015-5178	–	2%	Oct 27	The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which… Affected: through 2.0.0
CVE-2014-0018	–	0%	Feb 14	Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular… Affected: All versions, or not specified