Red Hat JBoss Operations Network vulnerabilities

24 CVEs affecting Red Hat JBoss Operations Network, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-4104, published 2021-12-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-7501, published 2017-11-09. Critical severity, CVSS 9.8. EPSS: 85.6% chance of exploitation in the next 30 days. Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service…
CVE-2021-4104, published 2021-12-14. High severity, CVSS 7.5. EPSS: 80.6% chance of exploitation in the next 30 days. JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and…
CVE-2013-2165, published 2013-07-23. High severity, CVSS 7.5. EPSS: 12.7% chance of exploitation in the next 30 days. ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise…
CVE-2016-6330, published 2016-09-27. Critical severity, CVSS 9.8. EPSS: 10.6% chance of exploitation in the next 30 days. The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers to execute arbitrary code via a crafted…
CVE-2016-3737, published 2016-08-02. Critical severity, CVSS 9.8. EPSS: 6.8% chance of exploitation in the next 30 days. The server in Red Hat JBoss Operations Network (JON) before 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.
CVE-2020-14340, published 2021-06-02. Medium severity, CVSS 5.9. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage collection cycles. It may allow the attacker to cause a denial…
CVE-2015-0297, published 2015-04-24. High severity, CVSS 9.0. EPSS: 2.2% chance of exploitation in the next 30 days. Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methods via the (1) ServerInvokerServlet or (2)…
CVE-2016-5422, published 2016-09-07. High severity, CVSS 8.8. EPSS: 2.1% chance of exploitation in the next 30 days. The web console in Red Hat JBoss Operations Network (JON) before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain…
CVE-2014-7853, published 2015-02-13. Medium severity, CVSS 4.0. EPSS: 1.2% chance of exploitation in the next 30 days. The JBoss Application Server (WildFly) JacORB subsystem in Red Hat JBoss Enterprise Application Platform (EAP) before 6.3.3 does not properly assign socket-binding-ref sensitivity classification to…
CVE-2012-1100, published 2014-02-14. Medium severity, CVSS 5.8. EPSS: 1.2% chance of exploitation in the next 30 days. Red Hat JBoss Operations Network (JON) 3.0.x before 3.0.1, 2.4.2, and earlier, when LDAP authentication is enabled and the LDAP bind account credentials are invalid, allows remote attackers to login…

Latest

CVE-2012-5626, published 2020-01-23. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in…
CVE-2008-5083, published 2019-11-08. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. In JON 2.1.x before 2.1.2 SP1, users can obtain unauthorized security information about private resources managed by JBoss ON.
CVE-2013-4374, published 2019-11-04. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. An insecurity temporary file vulnerability exists in RHQ Mongo DB Drift Server through 2013-09-25 when unpacking zipped files.
CVE-2010-0737, published 2019-10-30. High severity, CVSS 8.0. EPSS: 0.5% chance of exploitation in the next 30 days. A missing permission check was found in The CLI in JBoss Operations Network before 2.3.1 does not properly check permissions, which allows JBoss ON users to perform management tasks and configuration…
CVE-2019-3834, published 2019-10-03. High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days. It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits…