VendorsRed Hatjboss_enterprise_web_server1.0.0
Vulnerabilities

Red Hat RedHat JBoss Enterprise Web Server 1.0.0

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

13CVEs
CVE-2011-3923
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.
Published 2019-11-01 · Modified
9.81 PoCEPSS 0.895
CVE-2014-3700
eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data
Published 2019-11-21 · Modified
9.8EPSS 0.028
CVE-2014-3699
eDeploy has RCE via cPickle deserialization of untrusted data
Published 2019-12-15 · Modified
9.8EPSS 0.024
CVE-2014-3701
eDeploy has tmp file race condition flaws
Published 2019-12-15 · Modified
9.3EPSS 0.015
CVE-2016-2183
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
Published 2016-09-01 · Modified
7.5EPSS 0.947
CVE-2015-5183
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
Published 2017-09-25 · Modified
7.5EPSS 0.022
CVE-2015-5184
Console: CORS headers set to allow all in Red Hat AMQ.
Published 2017-09-25 · Modified
7.5EPSS 0.012
CVE-2012-5626
EJB method in Red Hat JBoss BRMS 5; Red Hat JBoss Enterprise Application Platform 5; Red Hat JBoss Operations Network 3.1; Red Hat JBoss Portal 4 and 5; Red Hat JBoss SOA Platform 4.2, 4.3, and 5; in Red Hat JBoss Enterprise Web Server 1 ignores roles specified using the @RunAs annotation.
Published 2020-01-23 · Modified
7.5EPSS 0.009
CVE-2012-0031
scoreboard.c in the Apache HTTP Server 2.2.21 and earlier might allow local users to cause a denial of service (daemon crash during shutdown) or possibly have unspecified other impact by modifying a certain type field within a scoreboard shared memory segment, leading to an invalid call to the free function.
Published 2012-01-18 · Modified
4.61 PoCEPSS 0.028
CVE-2012-0053
protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.
Published 2012-01-28 · Modified
4.31 PoCEPSS 0.822
CVE-2011-3348
The mod_proxy_ajp module in the Apache HTTP Server before 2.2.21, when used with mod_proxy_balancer in certain configurations, allows remote attackers to cause a denial of service (temporary "error state" in the backend server) via a malformed HTTP request.
Published 2011-09-19 · Modified
4.3EPSS 0.224
CVE-2014-3655
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
Published 2019-11-13 · Modified
4.3EPSS 0.005
CVE-2012-2148
An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies
Published 2019-12-06 · Modified
3.3EPSS 0.003