Filtered by vendor Redhat Subscriptions
Filtered by product Jboss Fuse Subscriptions
Total 563 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2016-1000340 2 Bouncycastle, Redhat 4 Legion-of-the-bouncy-castle-java-crytography-api, Jboss Fuse, Satellite and 1 more 2024-11-21 N/A
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.
CVE-2016-1000339 3 Bouncycastle, Debian, Redhat 5 Legion-of-the-bouncy-castle-java-crytography-api, Debian Linux, Jboss Fuse and 2 more 2024-11-21 N/A
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate.
CVE-2016-1000338 4 Bouncycastle, Canonical, Netapp and 1 more 6 Legion-of-the-bouncy-castle-java-crytography-api, Ubuntu Linux, 7-mode Transition Tool and 3 more 2024-11-21 7.5 High
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure.
CVE-2016-1000229 2 Redhat, Smartbear 4 Jboss Amq, Jboss Fuse, Openshift and 1 more 2024-11-21 6.1 Medium
swagger-ui has XSS in key names
CVE-2016-0782 2 Apache, Redhat 3 Activemq, Jboss Amq, Jboss Fuse 2024-11-21 N/A
The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
CVE-2016-0734 2 Apache, Redhat 3 Activemq, Jboss Amq, Jboss Fuse 2024-11-21 N/A
The web-based administration console in Apache ActiveMQ 5.x before 5.13.2 does not send an X-Frame-Options HTTP header, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web page that contains a (1) FRAME or (2) IFRAME element.
CVE-2015-9251 3 Jquery, Oracle, Redhat 51 Jquery, Agile Product Lifecycle Management For Process, Banking Platform and 48 more 2024-11-21 N/A
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
CVE-2015-7940 4 Bouncycastle, Opensuse, Oracle and 1 more 9 Bouncy Castle Crypto Package, Leap, Opensuse and 6 more 2024-11-21 N/A
The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid curve attack."
CVE-2015-7559 2 Apache, Redhat 4 Activemq, Jboss A-mq, Jboss Amq and 1 more 2024-11-21 2.7 Low
It was found that the Apache ActiveMQ client before 5.14.5 exposed a remote shutdown command in the ActiveMQConnection class. An attacker logged into a compromised broker could use this flaw to achieve denial of service on a connected client.
CVE-2015-7501 1 Redhat 22 Data Grid, Enterprise Linux, Jboss A-mq and 19 more 2024-11-21 N/A
Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift/xPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.
CVE-2015-6644 2 Google, Redhat 6 Android, Jboss Amq, Jboss Enterprise Application Platform and 3 more 2024-11-21 N/A
Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.
CVE-2015-5348 2 Apache, Redhat 2 Camel, Jboss Fuse 2024-11-21 N/A
Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
CVE-2015-5344 2 Apache, Redhat 2 Camel, Jboss Fuse 2024-11-21 N/A
The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
CVE-2015-5254 3 Apache, Fedoraproject, Redhat 5 Activemq, Fedora, Jboss Amq and 2 more 2024-11-21 N/A
Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execute arbitrary code via a crafted serialized Java Message Service (JMS) ObjectMessage object.
CVE-2015-5253 2 Apache, Redhat 2 Cxf, Jboss Fuse 2024-11-21 N/A
The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass authentication via a crafted SAML response with a valid signed assertion, related to a "wrapping attack."
CVE-2015-5184 1 Redhat 4 Amq, Jboss Amq, Jboss Enterprise Web Server and 1 more 2024-11-21 7.5 High
Console: CORS headers set to allow all in Red Hat AMQ.
CVE-2015-5183 1 Redhat 6 Amq, Amq Broker, Jboss A-mq and 3 more 2024-11-21 7.5 High
Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ.
CVE-2015-5181 1 Redhat 3 Jboss A-mq, Jboss Amq, Jboss Fuse 2024-11-21 N/A
The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript.
CVE-2015-3254 2 Apache, Redhat 4 Thrift, Jboss Amq, Jboss Data Virtualization and 1 more 2024-11-21 N/A
The client libraries in Apache Thrift before 0.9.3 might allow remote authenticated users to cause a denial of service (infinite recursion) via vectors involving the skip function.
CVE-2015-3253 3 Apache, Oracle, Redhat 14 Groovy, Health Sciences Clinical Development Center, Retail Order Broker Cloud Service and 11 more 2024-11-21 N/A
The MethodClosure class in runtime/MethodClosure.java in Apache Groovy 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.