DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2023-01-31
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, ein Cross-Site-Scritping-Angriff durchzuführen, Informationen offenzulegen, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.
01
beschreibt (19)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-3143US | high7.4 | — | ||
wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is… | ||||
| CVE-2022-46364US | critical9.8 | Exploit | ||
A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perform SSRF style attack… | ||||
| CVE-2022-45693US | high7.5 | — | ||
Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted string… | ||||
| CVE-2022-45047US | critical9.8 | Exploit | ||
Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.security.PrivateKey. The cl… | ||||
| CVE-2022-42004US | high7.5 | — | ||
In FasterXML jackson-databind before 2.13.4, resource exhaustion can occur because of a lack of a check in BeanDeserializer._deserializeFromArray to prevent use of deeply nested ar… | ||||
| CVE-2022-42003US | high7.5 | — | ||
In FasterXML jackson-databind before versions 2.13.4.1 and 2.12.17.1, resource exhaustion can occur because of a lack of a check in primitive value deserializers to avoid deep wrap… | ||||
| CVE-2022-40152US | high7.5 | — | ||
Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplied input, an attacker… | ||||
| CVE-2022-40150US | high7.5 | — | ||
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supp… | ||||
| CVE-2022-40149US | high7.5 | — | ||
Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supp… | ||||
| CVE-2020-11022US | medium6.1 | Exploit | ||
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append… | ||||
| CVE-2020-11023US | medium6.1OT kritisch | KEV | ||
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's… | ||||
| CVE-2019-11358US | medium6.1 | Exploit | ||
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source ob… | ||||
| CVE-2019-8331US | medium6.1 | Exploit | ||
In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute. | ||||
| CVE-2016-10735US | medium6.1 | Exploit | ||
In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041. | ||||
| CVE-2018-14042US | medium6.1 | Exploit | ||
In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip. | ||||
| CVE-2018-14041US | medium6.1 | Exploit | ||
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy. | ||||
| CVE-2018-14040US | medium6.1 | Exploit | ||
In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute. | ||||
| CVE-2017-18214US | high7.5 | — | ||
The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055. | ||||
| CVE-2015-9251US | medium6.1 | Exploit | ||
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2023:0552 vom 2023-01-31external
- Red Hat Security Advisory RHSA-2023:0553 vom 2023-01-31external
- Red Hat Security Advisory RHSA-2023:0554 vom 2023-01-31external
- Red Hat Security Advisory RHSA-2023:0556 vom 2023-01-31external
- Red Hat Security Advisory RHSA-2023:0560 vom 2023-02-08external
- Red Hat Security Advisory RHSA-2023:0713 vom 2023-02-09external
- Red Hat Security Advisory RHSA-2023:1043 vom 2023-03-02external
- Red Hat Security Advisory RHSA-2023:1044 vom 2023-03-02external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan