Skip to content
OpenAdvisories
Medium 1 exploited CVE WID-SEC-2024-3616 7 CVEs

Red Hat JBoss Fuse: Mehrere Schwachstellen

Published Oct 6, 2016 · Updated Dec 5, 2024 · Revision 6 · de-DE

Vendor: Juniper Networks Vendor: Red Hat Vendor: Ubuntu Product: JBoss A-MQ Product: JBoss Fuse Product: Junos Space Product: Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Fuse und Red Hat JBoss A-MQ ausnutzen, um einen Denial of Service Angriff durchzuführen, Code mit den Privilegien des angegriffenen Dienstes zur Ausführung bringen, vertrauliche Daten einzusehen, Informationen zu manipulieren oder Sicherheitsmechanismen zu umgehen.

Product

JBoss Fuse ist ein Open Source Enterprise Service Bus (ESB).
JBoss A-MQ ist eine Messaging-Plattform.

Vulnerabilities 7

  • Critical 9.8
    CVE-2016-4437 Exploited Public exploit Scanner template EPSS 93%

    Improper Access Control in Apache Shiro

    Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter.

    shiro shiro org.apache.shiro:shiro-core Debian Ubuntu Maven
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2015-5344

    Camel-xstream component in Apache Camel can allow remote attackers to execute arbitrary commands

    The camel-xstream component in Apache Camel before 2.15.5 and 2.16.x before 2.16.1 allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.

    org.apache.camel:camel-xstream Maven
  • Critical 9.8
    CVE-2016-2141

    Improper Input Validation in JGroups

    It was found that JGroups did not require necessary headers for encrypt and auth protocols from new nodes joining the cluster. An attacker could use this flaw to bypass security restrictions, and use this vulnerability to send and receive messages within the …

    org.jgroups:jgroups libjgroups-java libjgroups-java Debian Ubuntu Maven
  • High 8.1
    CVE-2015-5348

    Apache Camel can allow remote attackers to execute arbitrary commands

    Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an H…

    org.apache.camel:camel-http org.apache.camel:camel-http4 org.apache.camel:camel-servlet org.apache.camel:camel-http-common Maven
  • High 8.1
    CVE-2016-2510 EPSS 70%

    Improper Input Validation in BeanShell

    BeanShell (bsh) before 2.0b6, when included on the classpath by an application that uses Java serialization or XStream, allows remote attackers to execute arbitrary code via crafted serialized data, related to XThis.Handler.

    org.apache-extras.beanshell:bsh bsh bsh Debian Ubuntu Maven
  • Medium 5.5
    CVE-2015-3192

    Pivotal Spring Framework DoS Attack with XML Input

    Pivotal Spring Framework before 3.2.14 and 4.x before 4.1.7 do not properly process inline DTD declarations when DTD is not entirely disabled, which allows remote attackers to cause a denial of service (memory consumption and out-of-memory errors) via a craft…

    libspring-java libspring-java org.springframework:spring-web Debian Ubuntu Maven
  • Medium —
    CVE-2015-7940

    Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15

    The Bouncy Castle Java library before 1.51 does not validate a point is withing the elliptic curve, which makes it easier for remote attackers to obtain private keys via a series of crafted elliptic curve Diffie Hellman (ECDH) key exchanges, aka an "invalid c…

    bouncycastle bouncycastle org.bouncycastle:bcprov-jdk14 org.bouncycastle:bcprov-jdk15on Debian Ubuntu Maven

Revision history

  1. #6

    Neue Updates von Ubuntu aufgenommen

  2. #5

    Neue Updates von Juniper aufgenommen

  3. #4

    Referenz(en) aufgenommen: RHSA-2019:1545

  4. #1

    Initial Release

  5. #2

    Version nicht vorhanden

  6. #3

    Version nicht vorhanden

References