TI-2020-15666 CVE-2020-25649 · GHSA-288c-cq4h-88gq
XML external entity injection in jackson-databind
Priority MEDIUM 56
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly.
RHSA-2020:5361
Red Hat build of Thorntail 2.7.2 security and bug fix update
Released 2020-12-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Text-Only RHOAR
Fixes 5 records
TI-2020-15656 CVE-2020-25638 · GHSA-j8jw-g6fq-mp7h
SQL injection in hibernate-core
Priority MEDIUM 40
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final.
TI-2020-11170 CVE-2020-14299 · GHSA-vx2g-h7fh-g3vj
Improper authentication in picketbox
Priority LOW 32
A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded to admin-only mode.
TI-2020-11211 CVE-2020-14340 · GHSA-c738-77x8-wmq5
Uncontrolled resource consumption in XNIO
Priority LOW 31
A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles.
TI-2020-11209 CVE-2020-14338 · GHSA-w4jq-qh47-hvjq
Improper input validation in Wildfly
Priority LOW 27
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature.