Vulnerabilities

TI-2016-07810 CVE-2016-9589 · GHSA-p4xg-cpr9-vwvj

Uncontrolled resource consumption in Red Hat wildfly

LOW 38

Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02965 Published 2018-03-12 Fixed in 11.0.0.Beta1 CWE-400

TI-2018-00968 CVE-2018-1047 · GHSA-fmr4-w67p-vh8x

Improper input validation in Red Hat Wildfly

LOW 25

A flaw was found in Wildfly 9.x.

CVSS 3.0MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00509 Published 2018-01-24 Partial fix · 12.0.0 CWE-20

TI-2015-02829 CVE-2015-3198 · GHSA-4vwv-x3gp-2j4g

The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows…

LOW 36

The Undertow module of WildFly 9.x before 9.0.0.CR2 and 10.x before 10.0.0.Alpha1 allows remote attackers to obtain the source code of a JSP page via a "/" at the end of a URL.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01757 Published 2017-07-21 Fixed in 9.0.0.CR2 CWE-200

TI-2016-04313 CVE-2016-4993 · GHSA-qcqr-hcjq-whfq

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red…

LOW 32

CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and con…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02548 Published 2016-09-26 Fixed in 11.0.0.Final CWE-113

TI-2016-00710 CVE-2016-0793 · GHSA-9q87-22gr-r8qf

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly…

MEDIUM 49

Incomplete blacklist vulnerability in the servlet filter restriction mechanism in WildFly (formerly JBoss Application Server) before 10.0.0.Final on Windows allows remote attackers to read the sensitive files in the (1)…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.14971 Published 2016-04-01 Fixed in 10.0.0.Final CWE-200

TI-2015-04382 CVE-2015-5220 · GHSA-9g5x-j6wf-xvr6

The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly…

LOW 28

The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service (memory consumption) via a large request…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.02978 Published 2015-10-27 Fixed CWE-119

TI-2015-04356 CVE-2015-5188 · GHSA-c2j4-9xj5-q5rr

Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red…

LOW 32

Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote atta…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.01138 Published 2015-10-27 Partial fix CWE-352

TI-2015-04346 CVE-2015-5178 · GHSA-9x2p-wcwc-h875

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and…

LOW 24

The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to c…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01724 Published 2015-10-27 Fixed CWE-254

TI-2014-00018 CVE-2014-0018 · GHSA-mxv4-hqqr-c5rm

Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application…

LOW 10

Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container (MSC) service registry…

CVSS 2.0LOW 1.9 Local No auth Interaction — EPSS 0.00354 Published 2014-02-14 Fixed CWE-264

Vulnerabilities

Filters