Redhat Jboss Fuse vulnerabilities

• red hat hawtio 4.0.0 for red hat build of apache camel 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.2 for spring boot +26 more +28 more Undertow: improper state management in proxy protocol parsing causes information leakage CVE-2024-7885 Fix available 7.5 HighAugust 21, 2024
• eclipse jetty, ietf http, http/2 +166 more +168 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2023-44487 In KEVPublic exploitFix available EPSS 100.0% 7.5 HighJuly 10, 2023
• red hat undertow, redhat build of quarkus, integration camel for spring boot +7 more +9 more Undertow client not checking server identity presented by server certificate in https connections CVE-2022-4492 Fix available 7.5 HighFebruary 23, 2023
• red hat undertow, netapp active iq unified manager, cloud secure agent +6 more +8 more A flaw was found in Undertow. Denial of service can be achieved as Undertow server waits for the... CVE-2022-2764 Fix available 4.9 MediumSeptember 1, 2022
• red hat undertow, redhat integration camel k, jboss fuse +2 more Undertow vulnerable to Dos via Large AJP request CVE-2022-2053 Fix available 7.5 HighAugust 5, 2022
• apache log4j, apache software foundation log4j 1.x, fedoraproject fedora +44 more +46 more Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2 CVE-2021-4104 Public exploitFix available EPSS 80.6% 7.5 HighDecember 14, 2021
• redhat wildfly elytron, quarkus, redhat build of quarkus +11 more +13 more Observable Discrepancy in Wildfly Elytron CVE-2021-3642 Fix available 5.3 MediumAugust 5, 2021
• redhat xnio, oracle communications cloud native core console, communications cloud native core network repository function +11 more +13 more Uncontrolled Resource Consumption in XNIO CVE-2020-14340 Fix available 5.9 MediumJune 2, 2021
• redhat kubernetes-client, a-mq online, build of quarkus +6 more +8 more Improper Limitation of a Pathname to a Restricted Directory in Fabric8 Kubernetes Client CVE-2021-20218 Fix available 7.4 HighMarch 16, 2021
• red hat undertow, redhat jboss fuse, openshift application runtimes +2 more Denial of service in Undertow CVE-2020-27782 Fix available 7.5 HighFebruary 23, 2021
• keycloak, redhat openshift application runtimes, single sign-on +1 more +3 more OIDC Logout redirect in keycloak CVE-2020-10734 Fix available 3.3 LowFebruary 11, 2021
• keycloak, redhat jboss fuse, openshift application runtimes +1 more +3 more Generation of Error Message Containing Sensitive Information in Keycloak CVE-2020-1717 2.7 LowFebruary 11, 2021
• redhat wildfly, netapp active iq unified manager, oncommand insight +8 more +10 more Uncontrolled Resource Consumption in WildFly CVE-2020-25689 Fix available 5.3 MediumOctober 30, 2020
• redhat wildfly openssl, netapp oncommand insight, oncommand workflow automation +7 more +9 more Wildfly-OpenSSL memory leak flaw CVE-2020-25644 Fix available 7.5 HighOctober 6, 2020
• redhat wildfly elytron, netapp oncommand insight, redhat codeready studio +4 more +6 more Session Fixation in WildFly Elytron CVE-2020-10714 Fix available 7.5 HighSeptember 23, 2020
• red hat wildfly, redhat jboss fuse +1 more A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed... CVE-2020-10718 Fix available 7.5 HighSeptember 16, 2020
• red hat wildfly, redhat amq, jboss-ejb-client +4 more +6 more Wildfly EJB Client causes DoS CVE-2020-14297 Fix available 6.5 MediumJuly 24, 2020
• red hat wildfly, redhat amq, jboss enterprise application platform continuous delivery +3 more +5 more A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat... CVE-2020-14307 6.5 MediumJuly 24, 2020
• keycloak, quarkus, redhat decision manager +4 more +6 more Improper Input Validation in Keycloak CVE-2020-1714 Fix available 7.5 HighMay 13, 2020
• keycloak, redhat jboss fuse, openshift application runtimes +2 more Improper Authentication for Keycloak CVE-2020-1718 Fix available 7.1 HighMay 12, 2020
• red hat undertow, redhat jboss data grid, jboss enterprise application platform +3 more +5 more Improper Input Validation in Undertow CVE-2020-1757 Fix available 8.1 HighApril 21, 2020
• red hat wildfly, redhat jboss data grid, jboss enterprise application platform +3 more +5 more Inadequate Encryption Strength and Algorithm Downgrade in Wildfly CVE-2019-14887 7.4 HighMarch 16, 2020
• fasterxml jackson-databind, apache geode, redhat decision manager +5 more +7 more Polymorphic deserialization of malicious object in jackson-databind CVE-2019-14892 Fix available 7.5 HighMarch 2, 2020
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +3 more +5 more Undertow vulnerable to Uncontrolled Resource Consumption CVE-2019-14888 Fix available 7.5 HighJanuary 23, 2020
• keycloak, redhat jboss enterprise application platform, jboss fuse +1 more +3 more Exposure of Sensitive Information to an Unauthorized Actor in Keycloak CVE-2019-14820 Fix available 4.3 MediumJanuary 8, 2020
• smartbear swagger-ui, redhat jboss fuse, openshift +2 more Improper Neutralization of Input During Web Page Generation in swagger-ui CVE-2016-1000229 Public exploitFix available 6.1 MediumDecember 20, 2019
• fasterxml jackson-mapper-asl, apache spark, debian linux +2 more +4 more Improper Restriction of XML External Entity Reference in jackson-mapper-asl CVE-2019-10172 Public exploitFix available EPSS 17.0% 5.9 MediumNovember 18, 2019
• red hat undertow, netapp active iq unified manager, redhat jboss data grid +4 more +6 more Potential to access user credentials from the log files when debug logging enabled CVE-2019-10212 Fix available 4.8 MediumOctober 2, 2019
• [unknown] fuse, redhat jboss fuse, jboss a-mq +2 more It was found that the JMX endpoint of Red Hat JBoss Fuse 6, and Red Hat A-MQ 6 deserializes the... CVE-2016-8653 5.3 MediumAugust 1, 2018
• apache karaf, redhat jboss a-mq, jboss fuse +2 more It was found that the Karaf container used by Red Hat JBoss Fuse 6.x, and Red Hat JBoss A-MQ 6.x,... CVE-2016-8648 7.2 HighAugust 1, 2018
• hawt hawtio, redhat jboss fuse +1 more Insecure cookie sharing in Hawtio CVE-2017-2589 Fix available 8.7 HighJuly 26, 2018
• red hat undertow, redhat jboss enterprise application platform, jboss fuse +1 more +3 more Incorrect Authorization in Undertow CVE-2017-12196 Fix available 4.8 MediumApril 18, 2018
• hawt hawtio, redhat jboss fuse +1 more The admin terminal in Hawt.io does not require authentication, which allows remote attackers to... CVE-2014-0121 9.8 CriticalDecember 29, 2017
• hawt hawtio, redhat jboss fuse +1 more Cross-site request forgery (CSRF) vulnerability in the admin terminal in Hawt.io allows remote... CVE-2014-0120 8.8 HighDecember 29, 2017
• apache activemq, redhat jboss a-mq, jboss fuse +2 more Improper Input Validation and Missing Authentication for Critical Function in Apache ActiveMQ CVE-2015-7559 Fix available 2.7 LowApril 24, 2017
• redhat data grid, jboss a-mq, openshift +12 more +14 more Deserialization of Untrusted Data in Apache commons collections CVE-2015-7501 Known exploitedPublic exploitFix available EPSS 85.6% 9.8 CriticalJanuary 14, 2016
• redhat jboss fuse Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions... CVE-2014-8175 6.0 MediumJuly 8, 2015
• async-http-client project async-http-client, redhat jboss fuse +1 more Insufficient Verification of Data Authenticity in Async Http Client CVE-2013-7398 Fix available 4.3 MediumMay 11, 2015
• async-http-client project async-http-client, redhat jboss fuse +1 more Insufficient Verification of Data Authenticity in Async Http Client CVE-2013-7397 Fix available 4.3 MediumMay 11, 2015
• igniterealtime smack api, redhat jboss fuse +1 more The Ignite Realtime Smack XMPP API 4.x before 4.0.2, and 3.x and 2.x when a custom SSLContext is... CVE-2014-5075 6.8 MediumOctober 25, 2014
• redhat jboss overlord run time governance, jboss fuse service works +1 more JBoss Overlord Run Time Governance (RTGov) 1.0 for JBossAS allows remote authenticated users to... CVE-2013-6469 6.5 MediumApril 21, 2014
• redhat jboss fuse, jboss a-mq +1 more Exposure of Sensitive Information to an Unauthorized Actor in JBoss Fuse CVE-2014-0085 Fix available 2.1 LowApril 17, 2014
• redhat jboss a-mq, jboss fuse +1 more Multiple cross-site scripting (XSS) vulnerabilities in Fuse Management Console in Red Hat JBoss... CVE-2013-4372 4.3 MediumSeptember 30, 2013
• apache cxf, redhat jboss enterprise application platform, jboss enterprise portal platform +3 more +5 more Inadequate Encryption Strength in Apache CXF CVE-2012-5575 Public exploitFix available 6.4 MediumAugust 19, 2013