Filtered by vendor Redhat Subscriptions
Filtered by product Jboss Enterprise Bpms Platform Subscriptions
Total 209 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-25649 7 Apache, Fasterxml, Fedoraproject and 4 more 50 Iotdb, Jackson-databind, Fedora and 47 more 2024-11-21 7.5 High
A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.
CVE-2020-25638 5 Debian, Hibernate, Oracle and 2 more 14 Debian Linux, Hibernate Orm, Communications Cloud Native Core Console and 11 more 2024-11-21 7.4 High
A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SQL comments of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks. The highest threat from this vulnerability is to data confidentiality and integrity.
CVE-2020-1954 4 Apache, Netapp, Oracle and 1 more 15 Cxf, Oncommand Workflow Automation, Snapmanager and 12 more 2024-11-21 5.3 Medium
Apache CXF has the ability to integrate with JMX by registering an InstrumentationManager extension with the CXF bus. If the ‘createMBServerConnectorFactory‘ property of the default InstrumentationManagerImpl is not disabled, then it is vulnerable to a man-in-the-middle (MITM) style attack. An attacker on the same host can connect to the registry and rebind the entry to another server, thus acting as a proxy to the original. They are then able to gain access to all of the information that is sent and received over JMX.
CVE-2020-1945 6 Apache, Canonical, Fedoraproject and 3 more 54 Ant, Ubuntu Linux, Fedora and 51 more 2024-11-21 6.3 Medium
Apache Ant 1.1 to 1.9.14 and 1.10.0 to 1.10.7 uses the default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process.
CVE-2020-1748 1 Redhat 9 Decision Manager, Jboss Data Grid, Jboss Enterprise Application Platform and 6 more 2024-11-21 7.5 High
A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.
CVE-2020-1718 1 Redhat 7 Jboss Enterprise Bpms Platform, Jboss Enterprise Brms Platform, Jboss Fuse and 4 more 2024-11-21 7.1 High
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.
CVE-2020-1714 2 Quarkus, Redhat 11 Quarkus, Decision Manager, Jboss Enterprise Application Platform and 8 more 2024-11-21 8.8 High
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.
CVE-2020-14338 1 Redhat 7 Jboss Enterprise Application Platform, Jboss Enterprise Bpms Platform, Jboss Enterprise Brms Platform and 4 more 2024-11-21 5.3 Medium
A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfly enforced the "use-grammar-pool-only" feature. This flaw allows a specially-crafted XML file to manipulate the validation process in certain cases. This issue is the same flaw as CVE-2020-14621, which affected OpenJDK, and uses a similar code. This flaw affects all Xerces JBoss versions before 2.12.0.SP3.
CVE-2020-14062 5 Debian, Fasterxml, Netapp and 2 more 18 Debian Linux, Jackson-databind, Active Iq Unified Manager and 15 more 2024-11-21 8.1 High
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).
CVE-2020-14061 5 Debian, Fasterxml, Netapp and 2 more 20 Debian Linux, Jackson-databind, Active Iq Unified Manager and 17 more 2024-11-21 8.1 High
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).
CVE-2020-14060 4 Fasterxml, Netapp, Oracle and 1 more 17 Jackson-databind, Active Iq Unified Manager, Steelstore Cloud Integrated Storage and 14 more 2024-11-21 8.1 High
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
CVE-2020-13956 5 Apache, Netapp, Oracle and 2 more 27 Httpclient, Active Iq Unified Manager, Snapcenter and 24 more 2024-11-21 5.3 Medium
Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.
CVE-2020-13692 6 Debian, Fedoraproject, Netapp and 3 more 14 Debian Linux, Fedora, Steelstore Cloud Integrated Storage and 11 more 2024-11-21 7.7 High
PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.
CVE-2020-11988 3 Apache, Fedoraproject, Redhat 5 Xmlgraphics Commons, Fedora, Jboss Enterprise Bpms Platform and 2 more 2024-11-21 8.2 High
Apache XmlGraphics Commons 2.4 and earlier is vulnerable to server-side request forgery, caused by improper input validation by the XMPParser. By using a specially-crafted argument, an attacker could exploit this vulnerability to cause the underlying server to make arbitrary GET requests. Users should upgrade to 2.6 or later.
CVE-2020-11620 5 Debian, Fasterxml, Netapp and 2 more 26 Debian Linux, Jackson-databind, Active Iq Unified Manager and 23 more 2024-11-21 8.1 High
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).
CVE-2020-11619 5 Debian, Fasterxml, Netapp and 2 more 31 Debian Linux, Jackson-databind, Active Iq Unified Manager and 28 more 2024-11-21 8.1 High
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
CVE-2020-11612 6 Debian, Fedoraproject, Netapp and 3 more 26 Debian Linux, Fedora, Oncommand Api Services and 23 more 2024-11-21 7.5 High
The ZlibDecoders in Netty 4.1.x before 4.1.46 allow for unbounded memory allocation while decoding a ZlibEncoded byte stream. An attacker could send a large ZlibEncoded byte stream to the Netty server, forcing the server to allocate all of its free memory to a single decoder.
CVE-2020-11113 5 Debian, Fasterxml, Netapp and 2 more 41 Debian Linux, Jackson-databind, Steelstore Cloud Integrated Storage and 38 more 2024-11-21 8.8 High
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2020-11112 5 Debian, Fasterxml, Netapp and 2 more 39 Debian Linux, Jackson-databind, Steelstore Cloud Integrated Storage and 36 more 2024-11-21 8.8 High
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
CVE-2020-11111 5 Debian, Fasterxml, Netapp and 2 more 33 Debian Linux, Jackson-databind, Steelstore Cloud Integrated Storage and 30 more 2024-11-21 8.8 High
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).