jboss_enterprise_application_platform Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/jboss_enterprise_application_platform/ Sun, 26 Feb 2023 06:44:52 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png jboss_enterprise_application_platform Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/jboss_enterprise_application_platform/ 32 32 CVE-2018-1047 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1047/ Sun, 26 Feb 2023 06:44:52 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1047/ A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.

The post CVE-2018-1047 appeared first on CVE Vulnerability.

]]> A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.

The post CVE-2018-1047 appeared first on CVE Vulnerability.

]]> CVE-2020-10687 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10687/ Sun, 26 Feb 2023 06:35:55 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10687/ A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than […]

The post CVE-2020-10687 appeared first on CVE Vulnerability.

]]> A flaw was discovered in all versions of Undertow before Undertow 2.2.0.Final, where HTTP request smuggling related to CVE-2017-2666 is possible against HTTP/1.x and HTTP/2 due to permitting invalid characters in an HTTP request. This flaw allows an attacker to poison a web-cache, perform an XSS attack, or obtain sensitive information from request other than their own.

The post CVE-2020-10687 appeared first on CVE Vulnerability.

]]> CVE-2020-10688 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10688/ Sun, 26 Feb 2023 06:35:55 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10688/ A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

The post CVE-2020-10688 appeared first on CVE Vulnerability.

]]> A cross-site scripting (XSS) flaw was found in RESTEasy in versions before 3.11.1.Final and before 4.5.3.Final, where it did not properly handle URL encoding when the RESTEASY003870 exception occurs. An attacker could use this flaw to launch a reflected XSS attack.

The post CVE-2020-10688 appeared first on CVE Vulnerability.

]]> CVE-2020-10705 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-10705/ Sun, 26 Feb 2023 06:35:55 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-10705/ A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the “Expect: 100-continue” header may cause an out of memory error. This flaw may potentially lead to a denial of service.

The post CVE-2020-10705 appeared first on CVE Vulnerability.

]]> A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the “Expect: 100-continue” header may cause an out of memory error. This flaw may potentially lead to a denial of service.

The post CVE-2020-10705 appeared first on CVE Vulnerability.

]]> CVE-2019-17531 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-17531/ Sun, 26 Feb 2023 06:31:36 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-17531/ A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible […]

The post CVE-2019-17531 appeared first on CVE Vulnerability.

]]> A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

The post CVE-2019-17531 appeared first on CVE Vulnerability.

]]> CVE-2019-17267 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-17267/ Sun, 26 Feb 2023 06:31:31 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-17267/ A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

The post CVE-2019-17267 appeared first on CVE Vulnerability.

]]> A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

The post CVE-2019-17267 appeared first on CVE Vulnerability.

]]> CVE-2019-16942 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-16942/ Sun, 26 Feb 2023 06:31:24 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-16942/ A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible […]

The post CVE-2019-16942 appeared first on CVE Vulnerability.

]]> A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

The post CVE-2019-16942 appeared first on CVE Vulnerability.

]]> CVE-2019-16943 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-16943/ Sun, 26 Feb 2023 06:31:24 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-16943/ A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible […]

The post CVE-2019-16943 appeared first on CVE Vulnerability.

]]> A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

The post CVE-2019-16943 appeared first on CVE Vulnerability.

]]> CVE-2019-16869 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-16869/ Sun, 26 Feb 2023 06:31:23 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-16869/ Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a “Transfer-Encoding : chunked” line), which leads to HTTP request smuggling.

The post CVE-2019-16869 appeared first on CVE Vulnerability.

]]> Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a “Transfer-Encoding : chunked” line), which leads to HTTP request smuggling.

The post CVE-2019-16869 appeared first on CVE Vulnerability.

]]> CVE-2019-16335 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-16335/ Sun, 26 Feb 2023 06:31:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-16335/ A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

The post CVE-2019-16335 appeared first on CVE Vulnerability.

]]> A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

The post CVE-2019-16335 appeared first on CVE Vulnerability.

]]>