Red Hat JBoss Middleware vulnerabilities

6 CVEs affecting Red Hat JBoss Middleware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4066, published 2023-09-27.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1304, published 2018-02-28. Medium severity, CVSS 5.9. EPSS: 17.1% chance of exploitation in the next 30 days. The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84…
CVE-2016-3674, published 2016-05-17. High severity, CVSS 7.5. EPSS: 8.2% chance of exploitation in the next 30 days. Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver, (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6) StandardStaxDriver, and (7) WstxDriver drivers in…
CVE-2017-7957, published 2017-04-29. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. XStream through 1.4.9, when a certain denyTypes workaround is not used, mishandles attempts to create an instance of the primitive type 'void' during unmarshalling, leading to a remote application…
CVE-2023-4853, published 2023-09-20. High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This…
CVE-2023-4065, published 2023-09-27. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Red Hat AMQ Broker Operator, where it displayed a password defined in ActiveMQArtemisAddress CR, shown in plain text in the Operator Log. This flaw allows an authenticated local…
CVE-2023-4066, published 2023-09-27. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in…