Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority HIGH 73
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.80599 · Published 2021-12-14 · Partial fix CWE-502
Priority MEDIUM 57
A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.05576 · Published 2020-03-02 · Partial fix · 2.9.10, 2.8.11.5 +1 CWE-200
Priority MEDIUM 49
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.05549 · Published 2022-08-31 · Partial fix CWE-179
Priority MEDIUM 48
A vulnerability was found in Undertow web server before 2.0.21.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03028 · Published 2019-06-12 · Partial fix · 2.0.21 CWE-532
Priority MEDIUM 46
A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01892 · Published 2019-10-02 · Partial fix · 2.0.20 CWE-532
Priority MEDIUM 46
A flaw was found in Infinispan through version 9.4.14.Final.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01957 · Published 2020-01-02 · Fixed in 9.4.15.Final CWE-384
Priority MEDIUM 46
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.11259 · Published 2017-04-13 · Partial fix · 4.0.37.Final, 4.1.1.Final CWE-835
Priority MEDIUM 44
A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.03089 · Published 2019-11-25 · Partial fix · 8.2.12.Final, 9.4.17.Final CWE-470
Priority MEDIUM 41
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.01095 · Published 2020-03-16 · Partial fix CWE-757
Priority MEDIUM 40
Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01186 · Published 2018-05-15 · Partial fix · 9.3.1.Final CWE-349
Priority LOW 39
undertow before version 2.0.23.Final is vulnerable to an information leak issue.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03478 · Published 2019-07-25 · Partial fix · 2.0.23 CWE-862
Priority LOW 38
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize…
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.01615 · Published 2020-04-21 · Partial fix · 2.1.0 CWE-20
Priority LOW 37
A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02365 · Published 2020-10-06 · Partial fix · 1.1.3.Final CWE-401
Priority LOW 37
A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02179 · Published 2020-01-23 · Partial fix · 2.0.28.SP1, 2.0.29.Final CWE-400
Priority LOW 34
A flaw was found in Infinispan.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00543 · Published 2023-12-18 · Fixed in 15.0.0.Dev07, 14.0.25.Final CWE-312
Priority LOW 33
A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02126 · Published 2020-07-06 · Partial fix · 5.3.18, 5.4.18 +1 CWE-89
Priority LOW 32
A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly closed while not able to connect to domain…
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01487 · Published 2020-10-30 · Partial fix · 21.0.1 CWE-401
Priority LOW 32
It was found that the REST API in Infinispan before version 9.0.0 did not properly enforce auth constraints.
CVSS 3.0MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01559 · Published 2018-07-16 · Partial fix · 9.0.0 CWE-306
Priority LOW 31
A flaw was found in Infinispan, which does not detect circular object references when unmarshalling.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01108 · Published 2023-12-18 · Partial fix · 4.6.2.Final CWE-1047
Priority LOW 31
A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.02212 · Published 2021-06-02 · Partial fix · 3.8.2.Final, 3.7.9.Final CWE-400
Priority LOW 31
A vulnerability was found in Hibernate-Validator.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02157 · Published 2019-11-08 · Partial fix · 6.0.18.Final, 6.1.0.Final +1 CWE-79
Priority LOW 30
A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00721 · Published 2023-12-18 · Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
Priority LOW 30
A flaw was found in Infinispan's REST.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00797 · Published 2023-12-18 · Partial fix · 15.0.0.Dev04, 14.0.18.Final CWE-304
Priority LOW 26
The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0119 · Published 2020-09-16 · Partial fix
THREATIST.IORead the docs