Red Hat JBoss Community Application Server vulnerabilities

3 CVEs affecting Red Hat JBoss Community Application Server, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2012-2148, published 2019-12-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2012-4529, published 2013-10-28. Medium severity, CVSS 4.3. EPSS: 2% chance of exploitation in the next 30 days. The org.apache.catalina.connector.Response.encodeURL method in Red Hat JBoss Web 7.1.x and earlier, when the tracking mode is set to COOKIE, sends the jsessionid in the URL of the first response of a…
CVE-2009-5066, published 2012-08-13. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments.
CVE-2012-2148, published 2019-12-06. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies