Red Hat JBoss Business Rules Management System vulnerabilities

3 CVEs affecting Red Hat JBoss Business Rules Management System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-2487, published 2020-03-11.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2011-2487, published 2020-03-11. Medium severity, CVSS 5.9. EPSS: 1.8% chance of exploitation in the next 30 days. The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
• CVE-2016-8608, published 2018-08-01. Medium severity, CVSS 5.4. EPSS: 1.3% chance of exploitation in the next 30 days. JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote, authenticated attackers that have privileges…
• CVE-2010-3857, published 2019-11-12. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter.