CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 1CVE-2018-12532
https://notcve.org/view.php?id=CVE-2018-12532
18 Jun 2018 — JBoss RichFaces 4.5.3 through 4.5.17 allows unauthenticated remote attackers to inject an arbitrary expression language (EL) variable mapper and execute arbitrary Java code via a MediaOutputResource's resource request, aka RF-14309. JBoss RichFaces, de la versión 4.5.3 hasta la 4.5.17, permite que atacantes remotos no autenticados inyecten un mapper de variable de lenguaje de expresión (EL) arbitrario y ejecute código Java arbitrario mediante una petición de recursos a MediaOutputResource. Esto también se c... • http://seclists.org/fulldisclosure/2020/Mar/21 • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •
CVSS: 6.8EPSS: 1%CPEs: 1EXPL: 1CVE-2015-0279 – RichFaces: Remote Command Execution via insufficient EL parameter sanitization
https://notcve.org/view.php?id=CVE-2015-0279
25 Mar 2015 — JBoss RichFaces before 4.5.4 allows remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via the do parameter. JBoss RichFaces anterior a 4.5.4 permite a atacantes remotos inyectar expresiones del lenguaje de expresiones (EL) y ejecutar código Java arbitrario a través del parámetro do. It was found that the 'do' parameter permitted expression language (EL) injection, which could allow a remote attacker to execute Java methods on an affected server. Red Hat JBoss We... • https://packetstorm.news/files/id/156663 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 4.3EPSS: 1%CPEs: 6EXPL: 1CVE-2014-0086 – RichFaces: remote denial of service via memory exhaustion
https://notcve.org/view.php?id=CVE-2014-0086
26 Mar 2014 — The doFilter function in webapp/PushHandlerFilter.java in JBoss RichFaces 4.3.4, 4.3.5, and 5.x allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a large number of malformed atmosphere push requests. La función doFilter en webapp/PushHandlerFilter.java en JBoss RichFaces 4.3.4, 4.3.5 y 5.x permite a atacantes remotos causar una denegación de servicio (consumo de memoria y error de falta de memoria) a través de un número grande de solicitudes atmosphere pus... • http://rhn.redhat.com/errata/RHSA-2014-0335.html • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 3%CPEs: 99EXPL: 2CVE-2013-2165 – RichFaces: Remote code execution due to insecure deserialization
https://notcve.org/view.php?id=CVE-2013-2165
10 Jul 2013 — ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0, Red Hat JBoss Web Platform through 5.2.0, Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0, Red Hat JBoss BRMS through 5.3.1, Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1, Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2, and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the c... • https://packetstorm.news/files/id/156663 • CWE-264: Permissions, Privileges, and Access Controls CWE-502: Deserialization of Untrusted Data •