Red Hat JBoss Enterprise Web Server vulnerabilities

35 CVEs affecting Red Hat JBoss Enterprise Web Server, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-25710, published 2021-05-28.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability, published 2017-09-19. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.6% chance of exploitation in the next 30 days. When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to…
CVE-2016-8735: Apache Tomcat Remote Code Execution Vulnerability, published 2017-04-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-05-12. EPSS: 90.3% chance of exploitation in the next 30 days. Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an…
CVE-2014-0224, published 2014-06-05. High severity, CVSS 7.4. EPSS: 95.3% chance of exploitation in the next 30 days. OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a…
CVE-2016-2183, published 2016-09-01. High severity, CVSS 7.5. EPSS: 94.7% chance of exploitation in the next 30 days. The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for…
CVE-2011-3923, published 2019-11-01. Critical severity, CVSS 9.8. EPSS: 89.5% chance of exploitation in the next 30 days. Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
CVE-2015-7501, published 2017-11-09. Critical severity, CVSS 9.8. EPSS: 85.6% chance of exploitation in the next 30 days. Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service…
CVE-2012-0053, published 2012-01-28. Medium severity, CVSS 4.3. EPSS: 82.2% chance of exploitation in the next 30 days. protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to…
CVE-2017-9788, published 2017-07-13. Critical severity, CVSS 9.1. EPSS: 56.8% chance of exploitation in the next 30 days. In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value…
CVE-2016-5387, published 2016-07-19. High severity, CVSS 8.1. EPSS: 55.7% chance of exploitation in the next 30 days. The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable,…

Latest

CVE-2020-25710, published 2021-05-28. High severity, CVSS 7.5. EPSS: 2.7% chance of exploitation in the next 30 days. A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest…
CVE-2012-5626, published 2020-01-23. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in…
CVE-2019-19906, published 2019-12-19. High severity, CVSS 7.5. EPSS: 8% chance of exploitation in the next 30 days. cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by…
CVE-2014-3701, published 2019-12-15. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. eDeploy has tmp file race condition flaws
CVE-2014-3699, published 2019-12-15. Critical severity, CVSS 9.8. EPSS: 2.4% chance of exploitation in the next 30 days. eDeploy has RCE via cPickle deserialization of untrusted data
CVE-2012-2148, published 2019-12-06. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies
CVE-2014-3700, published 2019-11-21. Critical severity, CVSS 9.8. EPSS: 2.8% chance of exploitation in the next 30 days. eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data
CVE-2014-3655, published 2019-11-13. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. JBoss KeyCloak is vulnerable to soft token deletion via CSRF
CVE-2019-1559, published 2019-02-27. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling…