CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-0169
https://notcve.org/view.php?id=CVE-2014-0169
In JBoss EAP 6 a security domain is configured to use a cache that is shared between all applications that are in the security domain. This could allow an authenticated user in one application to access protected resources in another application without proper authorization. Although this is an intended functionality, it was not clearly documented which can mislead users into thinking that a security domain cache is isolated to a single application. En JBoss EAP versión 6, un dominio de seguridad está configurado para usar una caché que es compartida entre todas las aplicaciones que están en el dominio de seguridad. Esto podría permitir a un usuario autenticado en una aplicación acceder a recursos protegidos en otra aplicación sin la autorización apropiada. • https://access.redhat.com/security/cve/cve-2014-0169 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0169 • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2012-2312
https://notcve.org/view.php?id=CVE-2012-2312
An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges. Se presenta un problema de privilegios elevados en JBoss AS 7 Community Release, debido a la implementación inapropiada en la propagación del contexto de seguridad. Se reutiliza una amenaza del grupo de hilos (subprocesos) que aún conserva el contexto de seguridad del último proceso utilizado, lo que permite a un usuario local obtener privilegios elevados. • https://access.redhat.com/security/cve/cve-2012-2312 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2312 https://security-tracker.debian.org/tracker/CVE-2012-2312 • CWE-269: Improper Privilege Management •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 0CVE-2013-6495 – Bayeux: Reflected Cross-Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2013-6495
JBossWeb Bayeux has reflected XSS JBossWeb Bayeux presenta una vulnerabilidad de tipo XSS. • https://access.redhat.com/security/cve/cve-2013-6495 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-6495 https://access.redhat.com/security/cve/CVE-2013-6495 https://bugzilla.redhat.com/show_bug.cgi?id=1066794 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 6EXPL: 1CVE-2019-10172 – jackson-mapper-asl: XML external entity similar to CVE-2016-3720
https://notcve.org/view.php?id=CVE-2019-10172
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes. Se detectó un fallo en las bibliotecas org.codehaus.jackson:jackson-mapper-asl:1.9.x. Las vulnerabilidades de tipo XML external entity similares a CVE-2016-3720, también afectan a las bibliotecas codehaus jackson-mapper-asl pero en diferentes clases. A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries such that an XML external entity (XXE) vulnerability affects codehaus's jackson-mapper-asl libraries. • https://github.com/rusakovichma/CVE-2019-10172 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10172 https://lists.apache.org/thread.html/r0066c1e862613de402fee04e81cbe00bcd64b64a2711beb9a13c3b25%40%3Ccommits.cassandra.apache.org%3E https://lists.apache.org/thread.html/r04ecadefb27cda84b699130b11b96427f1d8a7a4066d8292f7f15ed8%40%3Ccommon-issues.hadoop.apache.org%3E https://lists.apache.org/thread.html/r08e1b73fabd986dcd2ddd7d09480504d1472264bed2f19b1d2002a9c%40%3Ccommon-issues.hadoop.apache.org%3E https://lists.apache.org/thread.html/r0d8c3e32a0a2d8a0b6118f5 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 4.3EPSS: 0%CPEs: 5EXPL: 0CVE-2019-14820 – keycloak: adapter endpoints are exposed via arbitrary URLs
https://notcve.org/view.php?id=CVE-2019-14820
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information. Se descubrió que keycloak versiones anteriores la versión 8.0.0, expone los endpoints del adaptador interno en org.keycloak.constants.AdapterConstants, que pueden ser invocadas por medio de una URL especialmente diseñada. Esta vulnerabilidad podría permitir a un atacante acceder a información no autorizada. It was found that keycloak exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14820 https://access.redhat.com/security/cve/CVE-2019-14820 https://bugzilla.redhat.com/show_bug.cgi?id=1649870 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •