Red Hat

Records7414All Threatist records

Exploited (KEV)98In CISA KEV

CVSS critical793CVSS 9.0–10.0

CVSS high2681CVSS 7.0–8.9

Exploited now

Red Hat records in CISA KEV

TI-2026-34021 Linux Kernel Missing Initialization of a Variable Vulnerability CRITICAL 93KEV 2026-10-28 TI-2015-04610 ISC BIND Data Processing Errors Vulnerability CRITICAL 92KEV 2026-10-08 TI-2026-35991 Kludex Starlette HTTP Request/Response Smuggling Vulnerability CRITICAL 86KEV 2026-09-02 TI-2015-02874 Red Hat Libuser Race Condition Vulnerability CRITICAL 92KEV 2026-08-26 TI-2015-04443 Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability CRITICAL 93KEV 2026-08-26 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04

Components

Products in the NVD configurations · select one to filter the records

Enterprise Linux 1956 records CRITICAL Enterprise Linux Desktop 1928 records CRITICAL Enterprise Linux Server 1891 records CRITICAL Enterprise Linux Workstation 1845 records CRITICAL Enterprise Linux Server Aus 1061 records CRITICAL Enterprise Linux Eus 796 records CRITICAL Enterprise Linux Server Tus 770 records CRITICAL Enterprise Linux Server Eus 622 records CRITICAL

Records

22 records in Jboss Enterprise Portal Platform · all components

TI-2013-01952 CVE-2013-2186 · GHSA-qx6h-9567-5fqw

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1…

MEDIUM 47

The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write to arbitrary files vi…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.12666 Published 2013-10-28 Partial fix · 1.3.1 CWE-20

TI-2013-01934 CVE-2013-2165 · GHSA-4344-frcp-j22q

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss…

MEDIUM 47

ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.12662 Published 2013-07-22 Partial fix · 3.3.3, 4.3.2 CWE-264

TI-2013-01951 CVE-2013-2185 · GHSA-v6c7-8qx5-8gmp

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used…

MEDIUM 43

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.07199 Published 2014-01-19 Partial fix · 7.0.39 CWE-20

TI-2011-03971 CVE-2011-4605 · GHSA-985p-jvqf-v48m

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss…

LOW 39

The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and 4.3.0.CP05, Portal Platform…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03521 Published 2012-11-23 Partial fix CWE-264

TI-2012-04691 CVE-2012-5575 · GHSA-7v5v-9v8r-w864

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does…

LOW 38

Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting,…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.06322 Published 2013-08-19 Partial fix · 2.5.10, 2.6.7 +1 CWE-310

TI-2013-00244 CVE-2013-0314 · GHSA-5gr9-q682-676m

The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not…

LOW 36

The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site contents, remove the site, or…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.01635 Published 2013-04-12 Partial fix CWE-287

TI-2014-02844 CVE-2014-3518 · GHSA-x7hh-cw6h-x3q4

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application…

LOW 35

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not pro…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02609 Published 2014-07-22 Fixed CWE-94

TI-2011-03603 CVE-2011-4085 · GHSA-24wp-35x7-5hx9

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before…

LOW 35

The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access control only for the…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0294 Published 2012-11-23 Fixed CWE-287

TI-2012-03060 CVE-2012-3532 · GHSA-fpcp-pjgq-5rf9

Cross-site request forgery (CSRF) vulnerability in the GateIn Portal component in JBoss…

LOW 31

Cross-site request forgery (CSRF) vulnerability in the GateIn Portal component in JBoss Enterprise Portal Platform 5.2.2 and earlier allows remote attackers to hijack the authentication of unspecified victims via unknown…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.00657 Published 2013-04-12 Partial fix CWE-352

TI-2011-02561 CVE-2011-2908 · GHSA-x3w9-v829-qphw

Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss…

LOW 30

Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authentic…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.01567 Published 2012-11-23 Partial fix CWE-352

TI-2011-02593 CVE-2011-2941 · GHSA-5f7q-2xrc-wxhx

Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0…

LOW 28

Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the initialURI parameter.

CVSS 2.0MEDIUM 5.8 Network No auth Interaction — EPSS 0.01128 Published 2014-02-26 Fixed CWE-20

TI-2011-01303 CVE-2011-1483 · GHSA-rj4p-7mm6-gm9j

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application…

LOW 28

wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA Platform 4.2.CP05, 4.3.CP0…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02664 Published 2013-07-28 Partial fix · 2.1.0.Final CWE-400

TI-2011-00949 CVE-2011-1096 · GHSA-r89h-jcj8-5p2m

The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in…

LOW 28

The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining (CBC) mode, al…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02587 Published 2012-11-23 Partial fix CWE-310

TI-2013-00245 CVE-2013-0315 · GHSA-rphh-qhqw-93pr

The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows…

LOW 26

The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 allows remote attackers to read arbitrary files via a crafted external XML entity in an XML document, aka an XML Entity Expansion (XEE) att…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.01371 Published 2013-04-12 Partial fix CWE-264

TI-2015-02872 CVE-2015-3244 · GHSA-3c2g-fm84-g225

The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in…

LOW 25

The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPortlet, does not properly restrict access to restricted resources, which allows r…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.01486 Published 2015-07-16 Fixed CWE-264

TI-2014-06525 CVE-2014-7852 · GHSA-cq25-j7mv-44h4

Cross-site scripting (XSS) vulnerability in JBoss RichFaces, as used in JBoss Portal…

LOW 22

Cross-site scripting (XSS) vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web script or HTML via crafted URL, which is not properly handled in a CSS file.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00974 Published 2014-12-11 Partial fix CWE-79

TI-2013-03877 CVE-2013-4424 · GHSA-38jw-6m6v-pmqm

Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00985 Published 2013-12-23 Partial fix CWE-79

TI-2012-04649 CVE-2012-5531 · GHSA-f38p-9g9f-crcv

Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal in JBoss…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal in JBoss Enterprise Portal Platform 5.2.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.00974 Published 2013-01-18 Partial fix CWE-79

TI-2011-03946 CVE-2011-4580 · GHSA-2p4j-3h9f-v3pj

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Enterprise Portal…

LOW 22

Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01005 Published 2014-02-26 Fixed CWE-79

TI-2012-02106 CVE-2012-2377 · GHSA-jm5c-rgfp-cjhx

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA…

LOW 19

JGroups diagnostics service in JBoss Enterprise Portal Platform before 5.2.2, SOA Platform before 5.3.0, and BRMS Platform before 5.3.0, is enabled without authentication when started by the JGroups channel, which allows…

CVSS 2.0LOW 3.3 Adjacent network No auth Interaction — EPSS 0.01448 Published 2012-11-23 Partial fix CWE-287

TI-2013-01871 CVE-2013-2102 · GHSA-wv8v-33h6-fw96

The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups…

LOW 18

The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to obtain sensitive informati…

CVSS 2.0LOW 3.3 Adjacent network No auth Interaction — EPSS 0.00985 Published 2013-10-28 Partial fix CWE-287

TI-2012-03912 CVE-2012-4572 · GHSA-w8gr-4mrr-7j77

Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before…

LOW 18

Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loa…

CVSS 2.0LOW 3.7 Local No auth Interaction — EPSS 0.00341 Published 2013-10-28 Partial fix CWE-264

Open these records in search →

Critical	793
High	2681
Medium	3429
Low	509
No CVSS	2