DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2020-05-11
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Angriff durchzuführen, einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen oder Dateien zu manipulieren.
01
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-1719US | medium5.4 | — | ||
A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is… | ||||
| CVE-2020-1729US | medium4.4OT erhöht | — | ||
A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any pe… | ||||
| CVE-2020-10705US | high7.5 | — | ||
A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw ma… | ||||
| CVE-2020-10719US | medium6.5 | — | ||
A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantag… | ||||
| CVE-2020-1732US | medium4.2 | — | ||
A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Securi… | ||||
| CVE-2020-1745US | critical9.8 | — | ||
A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0… | ||||
| CVE-2020-1757US | high8.1 | — | ||
A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet co… | ||||
| CVE-2020-7226US | high7.5 | — | ||
CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the… | ||||
| CVE-2019-17573US | medium6.1 | Exploit | ||
By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (… | ||||
| CVE-2019-12423US | high7.5 | — | ||
Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens iss… | ||||
| CVE-2019-10172US | high7.5 | Exploit | ||
A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libr… | ||||
| CVE-2016-3720US | critical9.8 | — | ||
XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown v… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Adivisory:RHSA-2020:2058 vom 2020-05-11external
- Red Hat Security Adivisory:RHSA-2020:2059 vom 2020-05-11external
- Red Hat Security Adivisory:RHSA-2020:2060 vom 2020-05-11external
- Red Hat Security Adivisory:RHSA-2020:2061 vom 2020-05-11external
- Red Hat Security Advisory RHSA-2020:2067 vom 2020-05-18external
- Red Hat Security Advisory RHSA-2020:2112 vom 2020-05-12external
- Red Hat Security Advisory RHSA-2020:2333 vom 2020-05-28external
- Red Hat Security Advisory RHSA-2020:2511 vom 2020-06-10external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan