Filtered by vendor Redhat Subscriptions
Filtered by product Jboss Core Services Subscriptions
Total 323 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-22826 5 Debian, Libexpat Project, Redhat and 2 more 6 Debian Linux, Libexpat, Enterprise Linux and 3 more 2025-05-05 8.8 High
nextScaffoldPart in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22825 5 Debian, Libexpat Project, Redhat and 2 more 6 Debian Linux, Libexpat, Enterprise Linux and 3 more 2025-05-05 8.8 High
lookup in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22824 5 Debian, Libexpat Project, Redhat and 2 more 6 Debian Linux, Libexpat, Enterprise Linux and 3 more 2025-05-05 9.8 Critical
defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22823 5 Debian, Libexpat Project, Redhat and 2 more 6 Debian Linux, Libexpat, Enterprise Linux and 3 more 2025-05-05 9.8 Critical
build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2022-22822 5 Debian, Libexpat Project, Redhat and 2 more 6 Debian Linux, Libexpat, Enterprise Linux and 3 more 2025-05-05 9.8 Critical
addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow.
CVE-2021-46143 5 Libexpat Project, Netapp, Redhat and 2 more 10 Libexpat, Active Iq Unified Manager, Clustered Data Ontap and 7 more 2025-05-05 8.1 High
In doProlog in xmlparse.c in Expat (aka libexpat) before 2.4.3, an integer overflow exists for m_groupSize.
CVE-2021-45960 6 Debian, Libexpat Project, Netapp and 3 more 10 Debian Linux, Libexpat, Active Iq Unified Manager and 7 more 2025-05-05 8.8 High
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
CVE-2023-3817 2 Openssl, Redhat 7 Openssl, Enterprise Linux, Jboss Core Services and 4 more 2025-05-05 5.3 Medium
Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the key or parameters that are being checked have been obtained from an untrusted source this may lead to a Denial of Service. The function DH_check() performs various checks on DH parameters. After fixing CVE-2023-3446 it was discovered that a large q parameter value can also trigger an overly long computation during some of these checks. A correct q value, if present, cannot be larger than the modulus p parameter, thus it is unnecessary to perform these checks if q is larger than p. An application that calls DH_check() and supplies a key or parameters obtained from an untrusted source could be vulnerable to a Denial of Service attack. The function DH_check() is itself called by a number of other OpenSSL functions. An application calling any of those other functions may similarly be affected. The other functions affected by this are DH_check_ex() and EVP_PKEY_param_check(). Also vulnerable are the OpenSSL dhparam and pkeyparam command line applications when using the "-check" option. The OpenSSL SSL/TLS implementation is not affected by this issue. The OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.
CVE-2023-0464 2 Openssl, Redhat 4 Openssl, Enterprise Linux, Jboss Core Services and 1 more 2025-05-05 7.5 High
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function.
CVE-2020-11993 8 Apache, Canonical, Debian and 5 more 16 Http Server, Ubuntu Linux, Debian Linux and 13 more 2025-05-01 7.5 High
Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. Configuring the LogLevel of mod_http2 above "info" will mitigate this vulnerability for unpatched servers.
CVE-2021-33193 6 Apache, Debian, Fedoraproject and 3 more 9 Http Server, Debian Linux, Fedora and 6 more 2025-05-01 7.5 High
A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. This issue affects Apache HTTP Server 2.4.17 to 2.4.48.
CVE-2021-36160 7 Apache, Broadcom, Debian and 4 more 16 Http Server, Brocade Fabric Operating System Firmware, Debian Linux and 13 more 2025-05-01 7.5 High
A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). This issue affects Apache HTTP Server versions 2.4.30 to 2.4.48 (inclusive).
CVE-2021-39275 7 Apache, Debian, Fedoraproject and 4 more 14 Http Server, Debian Linux, Fedora and 11 more 2025-05-01 9.8 Critical
ap_escape_quotes() may write beyond the end of a buffer when given malicious input. No included modules pass untrusted data to these functions, but third-party / external modules may. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2022-23943 5 Apache, Debian, Fedoraproject and 2 more 8 Http Server, Debian Linux, Fedora and 5 more 2025-05-01 9.8 Critical
Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.
CVE-2022-26377 4 Apache, Fedoraproject, Netapp and 1 more 6 Http Server, Fedora, Clustered Data Ontap and 3 more 2025-05-01 7.5 High
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requests to the AJP server it forwards requests to. This issue affects Apache HTTP Server Apache HTTP Server 2.4 version 2.4.53 and prior versions.
CVE-2022-28615 4 Apache, Fedoraproject, Netapp and 1 more 6 Http Server, Fedora, Clustered Data Ontap and 3 more 2025-05-01 9.1 Critical
Apache HTTP Server 2.4.53 and earlier may crash or disclose information due to a read beyond bounds in ap_strcmp_match() when provided with an extremely large input buffer. While no code distributed with the server can be coerced into such a call, third-party modules or lua scripts that use ap_strcmp_match() may hypothetically be affected.
CVE-2022-31813 4 Apache, Fedoraproject, Netapp and 1 more 6 Http Server, Fedora, Clustered Data Ontap and 3 more 2025-05-01 9.8 Critical
Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
CVE-2023-27522 4 Apache, Debian, Redhat and 1 more 6 Http Server, Debian Linux, Enterprise Linux and 3 more 2025-05-01 7.5 High
HTTP Response Smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi. This issue affects Apache HTTP Server: from 2.4.30 through 2.4.55. Special characters in the origin response header can truncate/split the response forwarded to the client.
CVE-2022-40303 4 Apple, Netapp, Redhat and 1 more 25 Ipados, Iphone Os, Macos and 22 more 2025-04-29 7.5 High
An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.
CVE-2022-40304 4 Apple, Netapp, Redhat and 1 more 25 Ipados, Iphone Os, Macos and 22 more 2025-04-28 7.8 High
An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.