CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 1CVE-2015-1849
https://notcve.org/view.php?id=CVE-2015-1849
19 Sep 2017 — AdvancedLdapLodinMogule in Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.1 allows attackers to obtain sensitive information via vectors involving logging the LDAP bind credential password when TRACE logging is enabled. AdvancedLdapLodinMogule en Red Hat JBoss Enterprise Application Platform (EAP) en versiones anteriores a la 6.4.1 permite que los atacantes obtengan información sensible mediante vectores que implican el registro de la contraseña de las credenciales asociadas al protocolo LDA... • https://bugzilla.redhat.com/show_bug.cgi?id=1199641 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.8EPSS: 1%CPEs: 7EXPL: 0CVE-2016-3690
https://notcve.org/view.php?id=CVE-2016-3690
08 Jun 2017 — The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload. El PooledInvokerServlet de Jboss EAP en sus versiones 4.x y 5.x permite a un atacante remoto la ejecución de un código aleatorio mediante un payload de diseño serializado. • http://www.securityfocus.com/bid/99079 • CWE-502: Deserialization of Untrusted Data •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2016-7061 – EAP: Sensitive data can be exposed at the server level in domain mode
https://notcve.org/view.php?id=CVE-2016-7061
19 Jan 2017 — An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configuring RBAC and marking information as sensitive, users with a Monitor role are able to view the sensitive information. Se ha detectado una vulnerabilidad de divulgación de información en JBoss Enterprise Application Platform en versiones anteriores a la 7.0.4. Se ha descubierto que, al configurar RBAC y marcar información como sensible, los usuarios con rol Monitor puede... • http://rhn.redhat.com/errata/RHSA-2017-0170.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.8EPSS: 7%CPEs: 2EXPL: 2CVE-2016-7065 – Red Hat JBoss EAP - Deserialization of Untrusted Data
https://notcve.org/view.php?id=CVE-2016-7065
13 Oct 2016 — The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly execute arbitrary code via a crafted serialized Java object. El servlet JMX en Red Hat JBoss Enterprise Application Platform (EAP) 4 y 5 permite a usuarios remotos autenticados provocar una denegación de servicio y posiblemente ejecutar código arbitrario a través de un objeto Java serializado manipulado. • https://packetstorm.news/files/id/139890 • CWE-502: Deserialization of Untrusted Data •
CVSS: 8.8EPSS: 1%CPEs: 3EXPL: 0CVE-2016-5406 – EAP7 Privilege escalation when managing domain including earlier version slaves
https://notcve.org/view.php?id=CVE-2016-5406
08 Sep 2016 — The domain controller in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2 allows remote authenticated users to gain privileges by leveraging failure to propagate administrative RBAC configuration to all slaves. El controlador de dominios en Red Hat JBoss Enterprise Application Platform (EAP) 7.x en versiones anteriores a 7.0.2 permite a usuarios remotos autenticados obtener privilegios aprovechando el fallo de propagación de configuración RBAC administrativa a todos los esclavos. The dom... • http://rhn.redhat.com/errata/RHSA-2016-1838.html • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.1EPSS: 0%CPEs: 4EXPL: 0CVE-2016-4993 – eap: HTTP header injection / response splitting
https://notcve.org/view.php?id=CVE-2016-4993
08 Sep 2016 — CRLF injection vulnerability in the Undertow web server in WildFly 10.0.0, as used in Red Hat JBoss Enterprise Application Platform (EAP) 7.x before 7.0.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors. Vulnerabilidad de inyección CRLF en el servidor web Undertow en WildFly 10.0.0, tal como se utiliza en Red Hat JBoss Enterprise Application Platform (EAP) 7.x en versiones anteriores a 7.0.2, permite a atacantes remotos inyectar c... • http://rhn.redhat.com/errata/RHSA-2016-1838.html • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') •
CVSS: 9.8EPSS: 1%CPEs: 1EXPL: 0CVE-2015-5304 – EAP: missing authorization check for Monitor/Deployer/Auditor role when shutting down server
https://notcve.org/view.php?id=CVE-2015-5304
03 Dec 2015 — Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows remote authenticated users with the Monitor, Deployer, or Auditor role to cause a denial of service via unspecified vectors. Red Hat JBoss Enterprise Application Platform (EAP) en versiones anteriores a 6.4.5 no autoriza adecuadamente el acceso para apagar el servidor, lo que permite a usuarios remotos autenticados con el rol Monitor, Deployer o Auditor causar una denegac... • http://rhn.redhat.com/errata/RHSA-2015-2538.html • CWE-264: Permissions, Privileges, and Access Controls CWE-862: Missing Authorization •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2015-5178 – AS/WildFly: missing X-Frame-Options header leading to clickjacking
https://notcve.org/view.php?id=CVE-2015-5178
15 Oct 2015 — The Management Console in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element. Management Console en Red Hat Enterprise Application Platform en versiones anteriores a 6.4.4 y WildFly (anteriormente JBoss Application Server) no envía una cabecera HTTP X-Frame-Options, lo ... • http://rhn.redhat.com/errata/RHSA-2015-1904.html • CWE-20: Improper Input Validation CWE-254: 7PK - Security Features •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2015-5188 – EAP: CSRF vulnerability in EAP & WildFly Web Console
https://notcve.org/view.php?id=CVE-2015-5188
15 Oct 2015 — Cross-site request forgery (CSRF) vulnerability in the Web Console (web-console) in Red Hat Enterprise Application Platform before 6.4.4 and WildFly (formerly JBoss Application Server) before 2.0.0.CR9 allows remote attackers to hijack the authentication of administrators for requests that make arbitrary changes to an instance via vectors involving a file upload using a multipart/form-data submission. Vulnerabilidad de CSRF en la Web Console (web-console) en Red Hat Enterprise Application Platform en versio... • http://rhn.redhat.com/errata/RHSA-2015-1904.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 1%CPEs: 2EXPL: 0CVE-2015-5220 – OOME from EAP 6 http management console
https://notcve.org/view.php?id=CVE-2015-5220
15 Oct 2015 — The Web Console in Red Hat Enterprise Application Platform (EAP) before 6.4.4 and WildFly (formerly JBoss Application Server) allows remote attackers to cause a denial of service (memory consumption) via a large request header. Web Console en Red Hat Enterprise Application Platform (EAP) en versiones anteriores a 6.4.4 y WildFly (anteriormente JBoss Application Server) permite a atacantes remotos provocar una denegación de servicio (consumo de la memoria) a través de una cabecera de petición grande. It was ... • http://rhn.redhat.com/errata/RHSA-2015-1904.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-770: Allocation of Resources Without Limits or Throttling •