Red Hat JBoss Brms vulnerabilities

8 CVEs affecting Red Hat JBoss Brms, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-14340, published 2021-06-02.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-19362, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.
• CVE-2018-19361, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.
• CVE-2018-19360, published 2019-01-02. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.
• CVE-2018-12023, published 2019-03-21. High severity, CVSS 7.5. EPSS: 8.9% chance of exploitation in the next 30 days. An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Oracle…
• CVE-2018-12022, published 2019-03-21. High severity, CVSS 7.5. EPSS: 7.3% chance of exploitation in the next 30 days. An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6. When Default Typing is enabled (either globally or for a specific property), the service has the Jodd-db…
• CVE-2016-7041, published 2018-09-10. Medium severity, CVSS 6.5. EPSS: 4% chance of exploitation in the next 30 days. Drools Workbench contains a path traversal vulnerability. The vulnerability allows a remote, authenticated attacker to bypass the directory restrictions and retrieve arbitrary files from the affected…
• CVE-2020-14340, published 2021-06-02. Medium severity, CVSS 5.9. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial…
• CVE-2012-5626, published 2020-01-23. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in…