Red Hat JBoss Enterprise Web Platform vulnerabilities

21 CVEs affecting Red Hat JBoss Enterprise Web Platform, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-2487, published 2020-03-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-0224, published 2014-06-05. High severity, CVSS 7.4. EPSS: 95.3% chance of exploitation in the next 30 days. OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a…
CVE-2012-0874, published 2013-02-05. Medium severity, CVSS 6.8. EPSS: 15.6% chance of exploitation in the next 30 days. The (1) JMXInvokerHAServlet and (2) EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and…
CVE-2013-2165, published 2013-07-23. High severity, CVSS 7.5. EPSS: 12.7% chance of exploitation in the next 30 days. ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise…
CVE-2012-5575, published 2013-08-19. Medium severity, CVSS 6.4. EPSS: 6.3% chance of exploitation in the next 30 days. Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite…
CVE-2011-4605, published 2012-11-23. High severity, CVSS 7.5. EPSS: 3.5% chance of exploitation in the next 30 days. The (1) JNDI service, (2) HA-JNDI service, and (3) HAJNDIFactory invoker servlet in JBoss Enterprise Application Platform 4.3.0 CP10 and 5.1.2, Web Platform 5.1.2, SOA Platform 4.2.0.CP05 and…
CVE-2014-0248, published 2014-07-07. Medium severity, CVSS 6.8. EPSS: 3.5% chance of exploitation in the next 30 days. org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform (JBEAP) 5.2.0, and JBoss Enterprise Web Platform (JBEWP) 5.2.0 allows remote…
CVE-2012-3369, published 2013-02-05. Medium severity, CVSS 4.0. EPSS: 2.7% chance of exploitation in the next 30 days. The CallerIdentityLoginModule in JBoss Enterprise Application Platform (EAP) before 5.2.0, Web Platform (EWP) before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote…
CVE-2013-4210, published 2013-10-01. Medium severity, CVSS 5.0. EPSS: 2.7% chance of exploitation in the next 30 days. The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other…
CVE-2011-1483, published 2013-07-29. Medium severity, CVSS 5.0. EPSS: 2.7% chance of exploitation in the next 30 days. wsf/common/DOMUtils.java in JBossWS Native in Red Hat JBoss Enterprise Application Platform 4.2.0.CP09, 4.3, and 5.1.1; JBoss Enterprise Portal Platform 4.3.CP06 and 5.1.1; JBoss Enterprise SOA…
CVE-2010-3862, published 2010-12-30. Low severity, CVSS 2.6. EPSS: 2.6% chance of exploitation in the next 30 days. The org.jboss.remoting.transport.bisocket.BisocketServerInvoker$SecondaryServerSocketThread.run method in JBoss Remoting 2.2.x before 2.2.3.SP4 and 2.5.x before 2.5.3.SP2 in Red Hat JBoss Enterprise…

Latest

CVE-2011-2487, published 2020-03-11. Medium severity, CVSS 5.9. EPSS: 1.8% chance of exploitation in the next 30 days. The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
CVE-2011-4610, published 2014-02-10. Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days. JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote…
CVE-2012-5629, published 2013-03-12. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. The default configuration of the (1) LdapLoginModule and (2) LdapExtLoginModule modules in JBoss Enterprise Application Platform (EAP) 4.3.0 CP10, 5.2.0, and 6.0.1, and Enterprise Web Platform (EWP)…
CVE-2013-0218, published 2013-02-05. Low severity, CVSS 2.1. EPSS: 0.4% chance of exploitation in the next 30 days. The GUI installer in JBoss Enterprise Application Platform (EAP) and Enterprise Web Platform (EWP) 5.2.0 and possibly 5.1.2 uses world-readable permissions for the auto-install XML file, which allows…