Filtered by vendor Redhat Subscriptions
Filtered by product Jboss Enterprise Bpms Platform Subscriptions
Total 209 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2019-0231 2 Apache, Redhat 6 Mina, Jboss Enterprise Bpms Platform, Jboss Enterprise Brms Platform and 3 more 2024-11-21 7.5 High
Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. Mitigation: 2.0.20 users should migrate to 2.0.21, 2.1.0 users should migrate to 2.1.1. This issue affects: Apache MINA.
CVE-2018-20677 2 Getbootstrap, Redhat 8 Bootstrap, Ceph Storage, Enterprise Linux and 5 more 2024-11-21 N/A
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
CVE-2018-20676 2 Getbootstrap, Redhat 8 Bootstrap, Ceph Storage, Enterprise Linux and 5 more 2024-11-21 N/A
In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.
CVE-2018-1000134 2 Pingidentity, Redhat 3 Ldapsdk, Jboss Enterprise Bpms Platform, Rhev Manager 2024-11-21 N/A
UnboundID LDAP SDK version from commit 801111d8b5c732266a5dbd4b3bb0b6c7b94d7afb up to commit 8471904a02438c03965d21367890276bc25fa5a6, where the issue was reported and fixed contains an Incorrect Access Control vulnerability in process function in SimpleBindRequest class doesn't check for empty password when running in synchronous mode. commit with applied fix https://github.com/pingidentity/ldapsdk/commit/8471904a02438c03965d21367890276bc25fa5a6#diff-f6cb23b459be1ec17df1da33760087fd that can result in Ability to impersonate any valid user. This attack appear to be exploitable via Providing valid username and empty password against servers that do not do additional validation as per https://tools.ietf.org/html/rfc4513#section-5.1.1. This vulnerability appears to have been fixed in after commit 8471904a02438c03965d21367890276bc25fa5a6.
CVE-2017-12629 4 Apache, Canonical, Debian and 1 more 9 Solr, Ubuntu Linux, Debian Linux and 6 more 2024-11-21 9.8 Critical
Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available, by default, for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.
CVE-2016-10735 2 Getbootstrap, Redhat 9 Bootstrap, Cloudforms Managementengine, Enterprise Linux and 6 more 2024-11-21 N/A
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
CVE-2023-4639 1 Redhat 14 Camel Quarkus, Camel Spring Boot, Integration and 11 more 2024-11-18 7.4 High
A flaw was found in Undertow, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
CVE-2023-6841 1 Redhat 7 Jboss Enterprise Bpms Platform, Jboss Fuse, Keycloak and 4 more 2024-11-15 7.5 High
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
CVE-2023-1932 1 Redhat 20 A Mq Clients, Amq Broker, Amq Online and 17 more 2024-11-08 6.1 Medium
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than character. Browsers may render an invalid html, allowing HTML injection or Cross-Site-Scripting (XSS) attacks.