Red Hat Security AdvisoryRHSA-2023:2135
Red Hat Process Automation Manager 7.13.3 security update
Released 2023-05-04 · Red Hat rating Important · View on Red Hat →
Fixes 12 records
Priority CRITICAL 94
Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.99931 · Published 2022-10-13 · Partial fix · 1.10.0 CWE-94
Priority HIGH 72
Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01488 · Published 2022-12-13 · Partial fix · 1.5.2 CWE-787
Priority HIGH 72
A flaw was found in codeplex-codehaus.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01347 · Published 2023-09-25 · Partial fix · 3.0.24 CWE-22
Priority MEDIUM 56
keycloak: path traversal via double URL encoding.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.05953 · Published 2023-01-11 · Partial fix · 20.0.2 CWE-22
Priority MEDIUM 53
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attacks on webservices that take at least one…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02315 · Published 2022-12-13 · Partial fix · 3.5.5, 3.4.10 CWE-918
Priority MEDIUM 45
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested arrays.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03409 · Published 2022-10-02 · Partial fix · 2.12.7.1, 2.13.4 CWE-502
Priority MEDIUM 41
A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01261 · Published 2022-12-13 · Partial fix · 3.5.5, 3.4.10 CWE-20
Priority LOW 39
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrapper array nesting, when the UNWRAP_SINGL…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03409 · Published 2022-10-02 · Partial fix · 2.12.7.1, 2.13.4.2 CWE-502
Priority LOW 36
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01771 · Published 2023-09-14 · Partial fix · 2.3.5, 2.2.24 +18 CWE-835
Priority LOW 36
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01647 · Published 2022-09-16 · Partial fix · 1.5.2 CWE-400
Priority LOW 36
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01677 · Published 2022-09-16 · Partial fix · 1.5.1 CWE-121
Priority LOW 21
A flaw was found in codehaus-plexus.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00694 · Published 2023-09-25 · Partial fix · 3.0.24 CWE-91
THREATIST.IORead the docs