Read the docs
Red Hat Security Advisory

RHSA-2014:0400

Red Hat JBoss Fuse 6.1.0 update

Released 2014-04-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 12 records

TI-2014-00048 CVE-2014-0050 · GHSA-xx68-jfcg-xmmf

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat…

Priority HIGH 80

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a craf…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.83334 Published 2014-03-28 Partial fix · 1.3.1, 8.0.3 +1 CWE-835
TI-2014-00050 CVE-2014-0054 · GHSA-8cmm-qj8g-fcp6

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8…

Priority HIGH 73

The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a d…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.91354 Published 2014-04-17 Partial fix · 3.2.8, 4.0.2 CWE-352
TI-2013-05382 CVE-2013-6429 · GHSA-g6hf-f9cq-q7w7

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and…

Priority HIGH 73

The SourceHttpMessageConverter in Spring MVC in Spring Framework before 3.2.5 and 4.0.0.M1 through 4.0.0.RC1 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a den…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.9056 Published 2014-01-26 Partial fix · 3.2.5.RELEASE CWE-352
TI-2013-03625 CVE-2013-4152 · GHSA-rp4p-g69r-438x

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB…

Priority MEDIUM 52

The Spring OXM wrapper in Spring Framework before 3.2.4 and 4.0.0.M1, when using the JAXB marshaller, does not disable entity resolution, which allows context-dependent attackers to read arbitrary files, cause a denial o…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.25634 Published 2014-01-23 Fixed in 3.2.4.RELEASE CWE-264
TI-2014-02908 CVE-2014-3584 · GHSA-gw5j-77f9-v2g2

The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before…

Priority LOW 33

The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.07177 Published 2014-10-30 Partial fix · 2.6.11, 2.7.8 +1 CWE-399
TI-2013-03964 CVE-2013-4517 · GHSA-4p4w-6h54-g885

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows…

Priority LOW 31

Apache Santuario XML Security for Java before 1.5.6, when applying Transforms, allows remote attackers to cause a denial of service (memory consumption) via crafted Document Type Definitions (DTDs), related to signatures…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.08863 Published 2014-01-11 Partial fix · 1.5.6 CWE-399
TI-2014-01485 CVE-2014-1904 · GHSA-ff7p-jqjm-v66h

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring…

Priority LOW 30

Cross-site scripting (XSS) vulnerability in web/servlet/tags/form/FormTag.java in Spring MVC in Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2 allows remote attackers to inject arbitrary web script or HTML vi…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.06896 Published 2014-03-20 Partial fix · 3.2.8.RELEASE, 4.0.2.RELEASE CWE-79
TI-2013-01939 CVE-2013-2172 · GHSA-r237-w2w6-jq3p

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security…

Priority LOW 29

jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 allows context-dependent attackers to spoof an XML Signature by using the Canon…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0593 Published 2013-08-20 Partial fix · 1.4.8, 1.5.5 CWE-310
TI-2013-05383 CVE-2013-6430 · GHSA-xjrf-8x4f-43h4

Cross-site scripting in Pivotal Spring MVC

Priority LOW 28

The JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework before 3.2.2 does not properly escape certain characters, which allows remote attackers to conduct cross-site…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01774 Published 2020-01-10 Partial fix · 3.2.2, 3.2.2.RELEASE CWE-79
TI-2013-01430 CVE-2013-1624 · GHSA-8353-fgcr-xfhx

The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library…

Priority LOW 24

The TLS implementation in the Bouncy Castle Java library before 1.48 and C# library before 1.8 does not properly consider timing side-channel attacks on a noncompliant MAC check operation during the processing of malform…

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.02972 Published 2013-02-08 Partial fix · 1.48 CWE-310
TI-2013-01806 CVE-2013-2035 · GHSA-49j7-qghp-5wj8

Race condition in…

Priority LOW 21

Race condition in hawtjni-runtime/src/main/java/org/fusesource/hawtjni/runtime/Library.java in HawtJNI before 1.8, when a custom library path is not specified, allows local users to execute arbitrary Java code by overwri…

CVSS 2.0MEDIUM 4.4 Local No auth Interaction — EPSS 0.00589 Published 2013-08-28 Partial fix · 1.8 CWE-94
TI-2013-01958 CVE-2013-2192 · GHSA-pxv5-5vmp-3jj4

The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before…

Priority LOW 18

The RPC protocol implementation in Apache Hadoop 2.x before 2.0.6-alpha, 0.23.x before 0.23.9, and 1.x before 1.2.1, when the Kerberos security features are enabled, allows man-in-the-middle attackers to disable bidirect…

CVSS 2.0LOW 3.2 Adjacent network No auth Interaction — EPSS 0.01069 Published 2014-01-24 Fixed in 2.0.6-alpha, 0.23.9 CWE-287