Red Hat JBoss Middleware Text-Only Advisories vulnerabilities

9 CVEs affecting Red Hat JBoss Middleware Text-Only Advisories, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-1132, published 2024-04-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-4437: Apache Shiro Code Execution Vulnerability, published 2016-06-07. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 93% chance of exploitation in the next 30 days. Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an…
CVE-2016-4970, published 2017-04-13. High severity, CVSS 7.5. EPSS: 11.3% chance of exploitation in the next 30 days. handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop).
CVE-2019-14439, published 2019-07-30. High severity, CVSS 7.5. EPSS: 10.8% chance of exploitation in the next 30 days. A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally…
CVE-2018-1288, published 2018-07-26. Medium severity, CVSS 5.4. EPSS: 4.8% chance of exploitation in the next 30 days. In Apache Kafka 0.9.0.0 to 0.9.0.1, 0.10.0.0 to 0.10.2.1, 0.11.0.0 to 0.11.0.2, and 1.0.0, authenticated Kafka users may perform action reserved for the Broker via a manually created fetch request…
CVE-2019-14900, published 2020-07-06. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is…
CVE-2011-2487, published 2020-03-11. Medium severity, CVSS 5.9. EPSS: 1.8% chance of exploitation in the next 30 days. The implementations of PKCS#1 v1.5 key transport mechanism for XMLEncryption in JBossWS and Apache WSS4J before 1.6.5 is susceptible to a Bleichenbacher attack.
CVE-2024-1132, published 2024-04-17. High severity, CVSS 8.1. EPSS: 1.6% chance of exploitation in the next 30 days. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access…
CVE-2023-4853, published 2023-09-20. High severity, CVSS 8.1. EPSS: 1.4% chance of exploitation in the next 30 days. A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This…
CVE-2022-1415, published 2023-09-11. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects…