Read the docs
Red Hat Security Advisory

RHSA-2020:4960

Red Hat Decision Manager 7.9.0 security update

Released 2020-11-05 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 11 records

TI-2019-13109 CVE-2019-17566 · GHSA-cmx4-p4v5-hmr5

Server-side request forgery in Apache Batik

Priority MEDIUM 46

Apache Batik is vulnerable to server-side request forgery, caused by improper input validation by the "xlink:href" attributes.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.10867 Published 2020-11-12 Partial fix · 1.13 CWE-918
TI-2020-08613 CVE-2020-10714 · GHSA-7fhr-2694-rg79

Session fixation in wildfly-elytron

Priority LOW 36

A flaw was found in WildFly Elytron version 1.11.3.Final and before.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01454 Published 2020-09-23 Partial fix · 1.11.4 CWE-384
TI-2020-01691 CVE-2020-1748 · GHSA-qgrq-cx4c-2rmm

Incorrect authorization in Wildfly

Priority LOW 36

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorizatio…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01438 Published 2020-09-16 Partial fix · 1.6.8 CWE-863
TI-2020-01878 CVE-2020-1954 · GHSA-ffm7-7r8g-77xm

Information disclosure in Apache CXF

Priority LOW 33

Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus.

CVSS 3.1MEDIUM 5.3 Adjacent network No auth No interaction EPSS 0.06147 Published 2020-04-01 Partial fix · 3.2.13, 3.3.6 CWE-200
TI-2019-11104 CVE-2019-14900 · GHSA-8grg-q944-cch5

SQL injection in Hibernate

Priority LOW 33

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02126 Published 2020-07-06 Partial fix · 5.3.18, 5.4.18 +1 CWE-89
TI-2020-01869 CVE-2020-1945 · GHSA-4p6w-m9wc-c9c9

Exposure of resource to wrong sphere in Apache Ant

Priority LOW 32

Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.01769 Published 2020-05-14 Partial fix · 1.9.15, 1.10.8 CWE-668
TI-2020-08595 CVE-2020-10693 · GHSA-rmrm-75hp-phr2

Improper input validation in hibernate-validator

Priority LOW 29

A flaw was found in Hibernate Validator version 6.1.2.Final.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.02351 Published 2020-05-06 Partial fix · 6.1.5.Final, 6.0.20.Final CWE-20