CVSS: 9.8EPSS: 94%CPEs: 444EXPL: 23CVE-2023-44487 – HTTP/2 Rapid Reset Attack Vulnerability
https://notcve.org/view.php?id=CVE-2023-44487
10 Oct 2023 — The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. El protocolo HTTP/2 permite una denegación de servicio (consumo de recursos del servidor) porque la cancelación de solicitudes puede restablecer muchas transmisiones rápidamente, como se explotó en la naturaleza entre agosto y octubre de 2023. A flaw was found in handling multiplexed streams in the HTTP/2 protocol. ... • https://packetstorm.news/files/id/211124 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 8.1EPSS: 0%CPEs: 18EXPL: 1CVE-2023-4853 – Quarkus: http security policy bypass
https://notcve.org/view.php?id=CVE-2023-4853
15 Sep 2023 — A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service. Se encontró una falla en Quarkus donde las políticas de seguridad HTTP no sanitiza correctamente ciertas permutaciones de caracteres al aceptar solicitudes, lo que res... • https://access.redhat.com/errata/RHSA-2023:5170 • CWE-148: Improper Neutralization of Input Leaders CWE-863: Incorrect Authorization •
CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 0CVE-2022-1415 – Drools: unsafe data deserialization in streamutils
https://notcve.org/view.php?id=CVE-2022-1415
11 Sep 2023 — A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server. Se encontró una falla en la que algunas clases de utilidad en el núcleo de Drools no usaban las medidas de seguridad adecuadas al deserializar datos. Esta falla permite a un atacante autenticado construir objetos serializados maliciosos (generalm... • https://access.redhat.com/errata/RHSA-2022:6813 • CWE-502: Deserialization of Untrusted Data •
CVSS: 7.8EPSS: 0%CPEs: 29EXPL: 0CVE-2023-1108 – Undertow: infinite loop in sslconduit during close
https://notcve.org/view.php?id=CVE-2023-1108
10 Mar 2023 — A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates. Se encontró una falla en undertow. Este problema hace posible lograr una denegación de servicio debido a un estado de protocolo de enlace inesperado actualizado en SslConduit, donde el bucle nunca termina Red Hat Single Sign-On is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized i... • https://access.redhat.com/errata/RHSA-2023:1184 • CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2019-14841
https://notcve.org/view.php?id=CVE-2019-14841
17 Oct 2022 — A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to gain admin privileges in the Business Central Console. Se encontró una falla en RHDM, donde un atacante autenticado puede cambiar su rol asignado en el encabezado de respuesta. Este fallo permite a un atacante conseguir privilegios de administrador en la consola de Business Central • https://access.redhat.com/security/cve/CVE-2019-14841 • CWE-281: Improper Preservation of Permissions •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2457
https://notcve.org/view.php?id=CVE-2022-2457
09 Aug 2022 — A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts. Se ha encontrado un fallo en Red Hat Process Automation Manager versión 7 por el que un atacante puede beneficiarse de un ataque de fuerza bruta contra la Consola de Administración ya que la aplicación no limita el número de intentos de inicio de sesión fallidos • https://bugzilla.redhat.com/show_bug.cgi?id=2107990#c0 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-2458 – Business-central: Possible XML External Entity Injection attack
https://notcve.org/view.php?id=CVE-2022-2458
09 Aug 2022 — XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, XML external entity injectio... • https://bugzilla.redhat.com/show_bug.cgi?id=2107994#c0 • CWE-91: XML Injection (aka Blind XPath Injection) CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-14839
https://notcve.org/view.php?id=CVE-2019-14839
01 Apr 2022 — It was observed that while login into Business-central console, HTTP request discloses sensitive information like username and password when intercepted using some tool like burp suite etc. Se ha observado que mientras es accedido a la consola de Business-central, una petición HTTP divulga información confidencial como el nombre de usuario y la contraseña cuando es interceptada usando alguna herramienta como burp suite, etc • https://bugzilla.redhat.com/show_bug.cgi?id=1748178 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 1CVE-2022-0853 – jboss-client: memory leakage in remote client transaction
https://notcve.org/view.php?id=CVE-2022-0853
11 Mar 2022 — A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability. Se ha encontrado un fallo en JBoss-client. La vulnerabilidad es producida debido a una pérdida de memoria en el lado del cliente de JBoss, cuando es usado UserTransaction repetidamente y conlleva a una vulnerabilidad de filtrado de información A flaw was found in the jboss-client. A memory leak on the JBoss client-side... • https://github.com/ByteHackr/CVE-2022-0853 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 6.7EPSS: 0%CPEs: 16EXPL: 0CVE-2021-4178 – kubernetes-client: Insecure deserialization in unmarshalYaml method
https://notcve.org/view.php?id=CVE-2021-4178
09 Feb 2022 — A arbitrary code execution flaw was found in the Fabric 8 Kubernetes client affecting versions 5.0.0-beta-1 and above. Due to an improperly configured YAML parsing, this will allow a local and privileged attacker to supply malicious YAML. Se ha encontrado un fallo de ejecución de código arbitrario en el cliente de Kubernetes Fabric 8 afectando a versiones 5.0.0-beta-1 y superiores. Debido a una configuración incorrecta del análisis de YAML, esto permitirá a un atacante local y con privilegios suministrar YA... • https://access.redhat.com/security/cve/CVE-2021-4178 • CWE-502: Deserialization of Untrusted Data •