Redhat Jboss_enterprise_web_server
36 CVEs affecting Redhat Jboss_enterprise_web_server. Latest disclosed: 2021-05-28. Critical: 7, High: 17.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-3699 | Critical | 9.8 | 2019-12-15 | eDeploy has RCE via cPickle deserialization of untrusted data |
CVE-2014-3700 | Critical | 9.8 | 2019-11-21 | eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data |
CVE-2011-3923 | Critical | 9.8 | 2019-11-01 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. |
CVE-2015-7501 | Critical | 9.8 | 2017-11-09 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x… |
CVE-2016-8735 | Critical | 9.8 | 2017-04-06 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRe… |
CVE-2016-5018 | Critical | 9.1 | 2017-08-10 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass… |
CVE-2017-9788 | Critical | 9.1 | 2017-07-13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset bef… |
CVE-2014-3701 | High | 8.1 | 2019-12-15 | eDeploy has tmp file race condition flaws |
CVE-2017-12617 | High | 8.1 | 2017-10-04 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the re… |
CVE-2017-12615 | High | 8.1 | 2017-09-19 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) i… |
CVE-2016-5387 | High | 8.1 | 2016-07-19 | The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in… |
CVE-2016-6325 | High | 7.8 | 2016-10-13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat an… |
CVE-2020-25710 | High | 7.5 | 2021-05-28 | A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed asser… |
CVE-2012-5626 | High | 7.5 | 2020-01-23 | EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Ha… |
CVE-2019-19906 | High | 7.5 | 2019-12-19 | cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The… |
CVE-2018-1336 | High | 7.5 | 2018-08-02 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Ver… |
CVE-2015-5184 | High | 7.5 | 2017-09-25 | Console: CORS headers set to allow all in Red Hat AMQ. |
CVE-2015-5183 | High | 7.5 | 2017-09-25 | Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ. |
CVE-2016-6796 | High | 7.5 | 2017-08-11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to… |
CVE-2016-6797 | High | 7.5 | 2017-08-10 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not… |