CVSS: 4.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-3655
https://notcve.org/view.php?id=CVE-2014-3655
JBoss KeyCloak is vulnerable to soft token deletion via CSRF JBoss KeyCloak es vulnerable a la eliminación del token soft por medio de CSRF • https://access.redhat.com/security/cve/cve-2014-3655 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3655 https://snyk.io/vuln/SNYK-JAVA-ORGKEYCLOAK-30138 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2015-5183 – Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ
https://notcve.org/view.php?id=CVE-2015-5183
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ. Consola: Atributos de HTTPOnly y Secure no establecidos en las cookies de Red Hat AMQ. It was found that Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user. • http://www.securitytracker.com/id/1041750 https://access.redhat.com/errata/RHSA-2018:2840 https://bugzilla.redhat.com/show_bug.cgi?id=1249182 https://lists.apache.org/thread.html/9e3391878c6840b294155f7ba6ccb47586e317f85c1bbd15c4608bd0%40%3Cdev.activemq.apache.org%3E https://lists.apache.org/thread.html/r51c60b28154fe7b634e5f5b7a7fc7f6f060487b39a7b5e95e2c32047%40%3Cdev.activemq.apache.org%3E https://lists.apache.org/thread.html/r63480b481eb5922465da102d97d0906d8823687f99ef3255ebc32be8%40%3Cdev.activemq.apache.org%3E https://lists.apache.org/thread& •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2015-5184 – Console: CORS headers set to allow all in Red Hat AMQ
https://notcve.org/view.php?id=CVE-2015-5184
Console: CORS headers set to allow all in Red Hat AMQ. Consola: Las cabeceras de CORS están preparadas para permitir a todos los de Red Hat AMQ. It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing (allow all). An attacker could use this flaw to access sensitive information or perform other attacks. • https://bugzilla.redhat.com/show_bug.cgi?id=1249183 https://lists.apache.org/thread.html/9e3391878c6840b294155f7ba6ccb47586e317f85c1bbd15c4608bd0%40%3Cdev.activemq.apache.org%3E https://lists.apache.org/thread.html/rb280e767ab199767e07a367f287ba08a9692fa76e2da4a20d50d07c4%40%3Cdev.activemq.apache.org%3E https://access.redhat.com/security/cve/CVE-2015-5184 •
CVSS: 7.5EPSS: 0%CPEs: 45EXPL: 1CVE-2016-2183 – SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)
https://notcve.org/view.php?id=CVE-2016-2183
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack. Los cifrados DES y Triple DES, como se usan en los protocolos TLS, SSH e IPSec y otros protocolos y productos, tienen una cota de cumpleaños de aproximadamente cuatro mil millones de bloques, lo que facilita a atacantes remotos obtener datos de texto plano a través de un ataque de cumpleaños contra una sesión cifrada de larga duración, según lo demostrado por una sesión HTTPS usando Triple DES en modo CBC, también conocido como un ataque "Sweet32". A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based ciphersuite. IBM Informix Dynamic Server suffers from dll injection, PHP code injection, and heap buffer overflow vulnerabilities. • http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10759 http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00022.html http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00023.html http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00024.html http://lists.opensuse.org/opensuse-security-announce/2016-09/msg00031.html http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00005.html http://lists.opensuse.org/opensuse-security-announce/2016-10/msg00011.h • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-327: Use of a Broken or Risky Cryptographic Algorithm •
CVSS: 9.8EPSS: 94%CPEs: 2EXPL: 2CVE-2011-3923 – Apache Struts - 'ParametersInterceptor' Remote Code Execution
https://notcve.org/view.php?id=CVE-2011-3923
Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. Apache Struts versiones anteriores a 2.3.1.2, permite a atacantes remotos omitir las protecciones de seguridad en la clase ParameterInterceptor y ejecutar comandos arbitrarios. • https://www.exploit-db.com/exploits/24874 http://seclists.org/fulldisclosure/2014/Jul/38 http://www.exploit-db.com/exploits/24874 http://www.securityfocus.com/bid/51628 http://www.securitytracker.com/id?1026575 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-3923 https://exchange.xforce.ibmcloud.com/vulnerabilities/72585 https://security-tracker.debian.org/tracker/CVE-2011-3923 • CWE-732: Incorrect Permission Assignment for Critical Resource •