Red Hat

Records7414All Threatist records

Exploited (KEV)98In CISA KEV

CVSS critical793CVSS 9.0–10.0

CVSS high2681CVSS 7.0–8.9

Exploited now

Red Hat records in CISA KEV

TI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability CRITICAL 93KEV 2026-10-28 TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability CRITICAL 86KEV 2026-09-02 TI-2015-02874 Red Hat Libuser Race Condition Vulnerability CRITICAL 92KEV 2026-08-26 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04

Components

Products in the NVD configurations · select one to filter the records

Enterprise Linux 1956 records CRITICAL Enterprise Linux Desktop 1928 records CRITICAL Enterprise Linux Server 1891 records CRITICAL Enterprise Linux Workstation 1845 records CRITICAL Enterprise Linux Server Aus 1061 records CRITICAL Enterprise Linux Eus 796 records CRITICAL Enterprise Linux Server Tus 770 records CRITICAL Enterprise Linux Server Eus 622 records CRITICAL

Records

23 records in Jboss Enterprise Brms Platform · all components

TI-2015-06239 CVE-2015-7501 · GHSA-fjq5-5j5f-mvxh

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data…

HIGH 84

Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Ope…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.85562 Published 2017-11-09 Partial fix · 3.2.2, 4.1 CWE-502

TI-2016-04319 CVE-2016-4999 · GHSA-44p5-rm8g-w75h

SQL injection vulnerability in the getStringParameterSQL method in…

MEDIUM 48

SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03653 Published 2016-08-05 Partial fix CWE-89

TI-2013-01952 CVE-2013-2186 · GHSA-qx6h-9567-5fqw

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1…

MEDIUM 47

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files vi…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.12666 Published 2013-10-28 Partial fix · 1.3.1 CWE-20

TI-2013-01934 CVE-2013-2165 · GHSA-4344-frcp-j22q

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss…

MEDIUM 47

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.12662 Published 2013-07-22 Partial fix · 3.3.3, 4.3.2 CWE-264

TI-2012-00809 CVE-2012-0874 · GHSA-cjrh-9rp2-h6f2

The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss…

MEDIUM 46

The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.15561 Published 2013-02-05 Partial fix CWE-287

TI-2015-00219 CVE-2015-0250 · GHSA-wfw6-mmmp-87xm

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion…

MEDIUM 45

XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of service via a crafted SVG f…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.16564 Published 2015-03-24 Partial fix · 1.8 CWE-20

TI-2016-04679 CVE-2016-5401 · GHSA-jgx4-4g5r-6f5v

Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows…

LOW 39

Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web page.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00625 Published 2017-04-20 No fix listed CWE-352

TI-2011-03971 CVE-2011-4605 · GHSA-985p-jvqf-v48m

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss…

LOW 39

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03521 Published 2012-11-23 Partial fix CWE-264

TI-2014-02844 CVE-2014-3518 · GHSA-x7hh-cw6h-x3q4

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application…

LOW 35

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not pro…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02609 Published 2014-07-22 Fixed CWE-94

TI-2011-03603 CVE-2011-4085 · GHSA-24wp-35x7-5hx9

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before…

LOW 35

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0294 Published 2012-11-23 Fixed CWE-287

TI-2013-05419 CVE-2013-6468 · GHSA-cq66-gwxj-2wjq

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1…

LOW 33

JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or (2) Drools expressio…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.02006 Published 2014-04-10 Partial fix CWE-94

TI-2012-02901 CVE-2012-3370 · GHSA-jrx8-2cjx-g9mh

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform…

LOW 30

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials…

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01862 Published 2013-02-05 Partial fix CWE-264

TI-2011-02561 CVE-2011-2908 · GHSA-x3w9-v829-qphw

Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss…

LOW 30

Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authentic…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01567 Published 2012-11-23 Partial fix CWE-352

TI-2013-03682 CVE-2013-4210 · GHSA-5mp8-w9f6-gv7r

The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for…

LOW 28

The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other products allows remote at…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02672 Published 2013-10-01 Partial fix

TI-2011-01303 CVE-2011-1483 · GHSA-rj4p-7mm6-gm9j

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application…

LOW 28

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP0…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02664 Published 2013-07-28 Partial fix · 2.1.0.Final CWE-400

TI-2012-04597 CVE-2012-5478 · GHSA-w372-6384-f8p5

The AuthorizationInterceptor in JBoss Enterprise Application Platform (EAP) before 5.2.0…

LOW 27

The AuthorizationInterceptor in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 does not properly restrict access, whic…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.02178 Published 2013-02-05 Partial fix CWE-264

TI-2011-03976 CVE-2011-4610 · GHSA-hh9c-c3q8-gv72

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web…

LOW 27

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02172 Published 2014-02-10 Partial fix CWE-119

TI-2012-02900 CVE-2012-3369 · GHSA-hgmc-pjc5-rw9x

The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before…

LOW 24

The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privil…

CVSS 2.0MEDIUM 4.0 Network No auth Interaction — EPSS 0.02685 Published 2013-02-05 Partial fix CWE-264

TI-2012-01073 CVE-2012-1167 · GHSA-9f9q-j576-jp97

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x…

LOW 24

The JBoss Server in JBoss Enterprise Application Platform 5.1.x before 5.1.2 and 5.2.x before 5.2.2, Web Platform before 5.1.2, BRMS Platform before 5.3.0, and SOA Platform before 5.3.0, when the server is configured to…

CVSS 2.0MEDIUM 4.6 Network Low privileges Interaction — EPSS 0.01604 Published 2012-11-23 Partial fix CWE-264

TI-2011-03941 CVE-2011-4575 · GHSA-v4j8-rhv4-55m7

Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise…

LOW 24

Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows r…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01794 Published 2013-02-05 Partial fix CWE-20

TI-2014-00005 CVE-2014-0005 · GHSA-hxxr-j64h-hx75

PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP)…

LOW 19

PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the application sever config…

CVSS 2.0LOW 3.6 Local No auth Interaction — EPSS 0.00799 Published 2015-02-20 Partial fix CWE-264

TI-2012-02106 CVE-2012-2377 · GHSA-jm5c-rgfp-cjhx

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA…

LOW 19

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows…

CVSS 2.0LOW 3.3 Adjacent network No auth Interaction — EPSS 0.01448 Published 2012-11-23 Partial fix CWE-287

TI-2012-00033 CVE-2012-0034 · GHSA-hcgg-293c-27px

The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and…

LOW 11

The NonManagedConnectionFactory in JBoss Enterprise Application Platform (EAP) 5.1.2 and 5.2.0, Web Platform (EWP) 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an excep…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.004 Published 2013-02-05 Partial fix CWE-255

Open these records in search →

Critical	793
High	2681
Medium	3429
Low	509
No CVSS	2