WaratekVRT Sign in
Reset
More filters (1)
Columns
Product: JBoss EAP✕
Overview 10 matches · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
10matches 1exploited10.0% 1CISA KEV10.0% 1public PoC10.0% 1EPSS ≥ 0.510.0%
Protected by Waratek 10 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 10 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 10 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 10.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 9 90.0%
split by peak 4 / year
Protected by Waratek: 10 Medium: 10 blocked by ARMR today: 10 No public exploit: 9Exploited: 1
20101 Protected by Waratek1 Medium1 blocked by ARMR today1 Exploited1 20110 20120 20130 20141 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20150 20160 20170 20184 Protected by Waratek4 Medium4 blocked by ARMR today4 No public exploit4 20192 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2 20202 Protected by Waratek2 Medium2 blocked by ARMR today2 No public exploit2
20102011201220132014201520162017201820192020
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2019-14900 Medium 2020-07-06 Protected by Waratek No public exploit A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.
CVE-2011-2487 Medium 2020-03-11 Protected by Waratek No public exploit The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
CVE-2019-10219 Medium 2019-11-08 Protected by Waratek No public exploit A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
CVE-2019-12400 Medium 2019-08-23 Protected by Waratek No public exploit In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this implementation might be cached and re-used by Apache Santuario - XML Security for Java, leading to potential security flaws when validating signed documents, etc. The vulnerability affects Apache Santuario - XML Security for Java 2.0.x releases from 2.0.3 and all 2.1.x releases before 2.1.4.
CVE-2018-10862 Medium 2018-07-27 Protected by Waratek No public exploit WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.
CVE-2018-10237 Medium 2018-04-26 Protected by Waratek No public exploit Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
CVE-2016-9585 Medium 2018-03-09 Protected by Waratek No public exploit Red Hat JBoss EAP version 5 is vulnerable to a deserialization of untrusted data in the JMX endpoint when deserializes the credentials passed to it. An attacker could exploit this vulnerability resulting in a denial of service attack.
CVE-2018-1047 Medium 2018-01-24 Protected by Waratek No public exploit A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.
CVE-2014-3481 Medium 2014-07-07 Protected by Waratek No public exploit org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform (JEAP) before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity (XXE) issue.
CVE-2010-0738 Medium 2010-04-28 Protected by Waratek Exploited The JMX-Console web application in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs access control only for the GET and POST methods, which allows remote attackers to send requests to this application's GET handler by using a different method.