Red Hat JBoss Enterprise Brms Platform vulnerabilities

23 CVEs affecting Red Hat JBoss Enterprise Brms Platform, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-7501, published 2017-11-09.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-7501, published 2017-11-09. Critical severity, CVSS 9.8. EPSS: 85.6% chance of exploitation in the next 30 days. Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service…
CVE-2015-0250, published 2015-03-24. Medium severity, CVSS 6.4. EPSS: 16.6% chance of exploitation in the next 30 days. XML external entity (XXE) vulnerability in the SVG to (1) PNG and (2) JPG conversion classes in Apache Batik 1.x before 1.8 allows remote attackers to read arbitrary files or cause a denial of…
CVE-2012-0874, published 2013-02-05. Medium severity, CVSS 6.8. EPSS: 15.6% chance of exploitation in the next 30 days. The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and…
CVE-2013-2186, published 2013-10-28. High severity, CVSS 7.5. EPSS: 12.7% chance of exploitation in the next 30 days. The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write…
CVE-2013-2165, published 2013-07-23. High severity, CVSS 7.5. EPSS: 12.7% chance of exploitation in the next 30 days. ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise…
CVE-2016-4999, published 2016-08-05. Critical severity, CVSS 9.8. EPSS: 3.7% chance of exploitation in the next 30 days. SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to…
CVE-2011-4605, published 2012-11-23. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and…
CVE-2011-4085, published 2012-11-23. Medium severity, CVSS 6.8. EPSS: 2.9% chance of exploitation in the next 30 days. The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access…
CVE-2012-3369, published 2013-02-05. Medium severity, CVSS 4.0. EPSS: 2.7% chance of exploitation in the next 30 days. The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote…
CVE-2013-4210, published 2013-10-01. Medium severity, CVSS 5.0. EPSS: 2.7% chance of exploitation in the next 30 days. The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other…

Latest

CVE-2016-5401, published 2017-04-20. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Cross-site request forgery (CSRF) vulnerability in Red Hat JBoss BRMS and BPMS 6 allows remote attackers to hijack the authentication of users for requests that modify instances via a crafted web…
CVE-2014-0005, published 2015-02-20. Low severity, CVSS 3.6. EPSS: 0.8% chance of exploitation in the next 30 days. PicketBox and JBossSX, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.2.2 and JBoss BRMS before 6.0.3 roll up patch 2, allows remote authenticated users to read and modify the…
CVE-2014-3518, published 2014-07-22. Medium severity, CVSS 6.8. EPSS: 2.6% chance of exploitation in the next 30 days. jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA…
CVE-2013-6468, published 2014-04-10. Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days. JBoss Drools, Red Hat JBoss BRMS before 6.0.1, and Red Hat JBoss BPM Suite before 6.0.1 allows remote authenticated users to execute arbitrary Java code via a (1) MVFLEX Expression Language (MVEL) or…
CVE-2011-4610, published 2014-02-10. Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days. JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote…