Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 73
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.80599 · Published 2021-12-14 · Partial fix CWE-502
Priority HIGH 72
A flaw was found in codeplex-codehaus.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01347 · Published 2023-09-25 · Partial fix · 3.0.24 CWE-22
Priority MEDIUM 40
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.02276 · Published 2023-09-20 · Partial fix · 1.9.2-3.el8, 2.13.8.Final-redhat-00005 +9 CWE-148
Priority MEDIUM 40
The undertow client is not checking the server identity presented by the server certificate in https connections.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00596 · Published 2023-02-23 · Partial fix · 2.3.5.Final, 2.2.24.Final CWE-918
Priority LOW 38
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02644 · Published 2024-08-21 · Partial fix · 2.2.36.Final, 2.3.17.Final +27 CWE-362
Priority LOW 36
A flaw was found in undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01771 · Published 2023-09-14 · Partial fix · 2.3.5, 2.2.24 +18 CWE-835
Priority LOW 36
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01392 · Published 2022-08-31 · Partial fix CWE-400
Priority LOW 36
A flaw was found in XNIO, specifically in the notifyReadClosed method.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01583 · Published 2022-08-26 · Partial fix CWE-770
Priority LOW 36
A flaw was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01774 · Published 2022-08-23 · Partial fix · 2.0.40, 2.2.10 CWE-400
Priority LOW 35
When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/prox…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01093 · Published 2022-08-05 · Partial fix · 2.2.19.Final, 2.3.0.Alpha2 CWE-400
Priority LOW 35
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.0088 · Published 2022-09-13 · Partial fix · 27.0.0.Beta1 CWE-1188
Priority LOW 35
A flaw was found in the fabric8 kubernetes-client in version 4.2.0 and after.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.01312 · Published 2021-03-16 · Partial fix · 4.7.2, 4.11.2 +2 CWE-22
Priority LOW 35
A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01246 · Published 2021-06-02 · Partial fix · 4.5.6.Final CWE-400
Priority LOW 30
A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above.
CVSS 3.1MEDIUM 6.7· Local · High privileges · No interaction · EPSS 0.00335 · Published 2022-08-24 · Partial fix · 5.0.3, 5.1.2 +5 CWE-502
Priority LOW 26
A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled.
CVSS 3.1MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00846 · Published 2021-08-05 · Partial fix · 1.10.14, 1.15.5 +1 CWE-203
Priority LOW 24
A flaw was found in Undertow.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00897 · Published 2022-09-01 · Partial fix CWE-400
Priority LOW 23
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00533 · Published 2021-05-20 · Partial fix · 23.0.2.Final CWE-79
Priority LOW 21
A flaw was found in codehaus-plexus.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00694 · Published 2023-09-25 · Partial fix · 3.0.24 CWE-91
Priority LOW 19
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00622 · Published 2023-03-03 · Partial fix CWE-200
THREATIST.IORead the docs