CVE-2014-3655 | Medium | 4.3 | 2019-11-13 | JBoss KeyCloak is vulnerable to soft token deletion via CSRF |
CVE-2014-3649 | Medium | 6.1 | 2019-11-04 | JBoss AeroGear has reflected XSS via the password field |
CVE-2016-8656 | High | 7.0 | 2018-05-22 | Jboss jbossas before versions 5.2.0-23, 6.4.13, 7.0.5 is vulnerable to an unsafe file handling in the jboss init script which could result in local privilege e… |
CVE-2018-1041 | High | 7.5 | 2018-02-15 | A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer. An attacker could use this… |
CVE-2016-2094 | High | 7.5 | 2016-05-06 | The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL handshake, aka a r… |
CVE-2014-0170 | | | 2014-09-30 | Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files via a crafted requ… |
CVE-2012-3428 | | | 2012-12-20 | The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does no… |
CVE-2008-3273 | | | 2008-08-10 | JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtain sensitive informa… |
CVE-2007-6433 | | | 2007-12-18 | The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject and execute arbitr… |
CVE-2007-1354 | | | 2007-07-27 | The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses a member variable… |
CVE-2007-1157 | | | 2007-03-02 | Cross-site request forgery (CSRF) vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as administrators via… |
CVE-2007-1036 | | | 2007-02-21 | The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authe… |
CVE-2006-5750 | | | 2006-11-27 | Directory traversal vulnerability in the DeploymentFileRepository class in JBoss Application Server (jbossas) 3.2.4 through 4.0.5 allows remote authenticated u… |
CVE-2005-4709 | | | 2005-12-31 | The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans (EJB) 3.0 RC3 maintains the threadPrincipal and threadCredential v… |
CVE-2005-2158 | | | 2005-07-06 | A regression error in the embedded HSQLDB in JBoss jBPM 2.0 allows remote attackers to execute arbitrary comands, a re-introduction of a vulnerability that was… |
CVE-2005-2006 | | | 2005-06-17 | JBOSS 3.2.2 through 3.2.7 and 4.0.2 allows remote attackers to obtain sensitive information via a GET request (1) with a "%." (percent dot), which reveals the… |
CVE-2003-0845 | | | 2003-11-17 | Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, allows remote attack… |