Red Hat JBoss Enterprise Portal Platform vulnerabilities

22 CVEs affecting Red Hat JBoss Enterprise Portal Platform, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-3244, published 2015-07-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-2186, published 2013-10-28. High severity, CVSS 7.5. EPSS: 12.7% chance of exploitation in the next 30 days. The DiskFileItem class in Apache Commons FileUpload, as used in Red Hat JBoss BRMS 5.3.1; JBoss Portal 4.3 CP07, 5.2.2, and 6.0.0; and Red Hat JBoss Web Server 1.0.2 allows remote attackers to write…
CVE-2013-2165, published 2013-07-23. High severity, CVSS 7.5. EPSS: 12.7% chance of exploitation in the next 30 days. ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise…
CVE-2013-2185, published 2014-01-19. High severity, CVSS 7.5. EPSS: 7.2% chance of exploitation in the next 30 days. The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers…
CVE-2012-5575, published 2013-08-19. Medium severity, CVSS 6.4. EPSS: 6.3% chance of exploitation in the next 30 days. Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite…
CVE-2011-4605, published 2012-11-23. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and…
CVE-2011-4085, published 2012-11-23. Medium severity, CVSS 6.8. EPSS: 2.9% chance of exploitation in the next 30 days. The servlets invoked by httpha-invoker in JBoss Enterprise Application Platform before 5.1.2, SOA Platform before 5.2.0, BRMS Platform before 5.3.0, and Portal Platform before 4.3 CP07 perform access…
CVE-2011-1483, published 2013-07-29. Medium severity, CVSS 5.0. EPSS: 2.7% chance of exploitation in the next 30 days. wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA…
CVE-2014-3518, published 2014-07-22. Medium severity, CVSS 6.8. EPSS: 2.6% chance of exploitation in the next 30 days. jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform (JEAP) 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA…
CVE-2011-1096, published 2012-11-23. Medium severity, CVSS 5.0. EPSS: 2.6% chance of exploitation in the next 30 days. The W3C XML Encryption Standard, as used in the JBoss Web Services (JBossWS) component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block…
CVE-2013-0314, published 2013-04-12. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. The GateIn Portal export/import gadget in JBoss Enterprise Portal Platform 5.2.2 does not properly check authentication when importing Zip files, which allows remote attackers to modify site…

Latest

CVE-2015-3244, published 2015-07-16. Medium severity, CVSS 4.9. EPSS: 1.5% chance of exploitation in the next 30 days. The Portlet Bridge for JavaServer Faces in Red Hat JBoss Portal 6.2.0, when used in portlets with the default resource serving for GenericPortlet, does not properly restrict access to restricted…
CVE-2014-7852, published 2014-12-11. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in JBoss RichFaces, as used in JBoss Portal 6.1.1, allows remote attackers to inject arbitrary web script or HTML via crafted URL, which is not properly…
CVE-2011-4580, published 2014-02-26. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2011-2941, published 2014-02-26. Medium severity, CVSS 5.8. EPSS: 1.1% chance of exploitation in the next 30 days. Open redirect vulnerability in Red Hat JBoss Enterprise Portal Platform before 5.2.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the…
CVE-2013-4424, published 2013-12-23. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-2102, published 2013-10-28. Low severity, CVSS 3.3. EPSS: 1% chance of exploitation in the next 30 days. The default configuration of Red Hat JBoss Portal before 6.1.0 enables the JGroups diagnostics service with no authentication when a JGroups channel is started, which allows remote attackers to…
CVE-2012-4572, published 2013-10-28. Low severity, CVSS 3.7. EPSS: 0.3% chance of exploitation in the next 30 days. Red Hat JBoss Enterprise Application Platform (EAP) before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an…