Skip to content
OpenAdvisories
High WID-SEC-2025-2123 12 CVEs

Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen

Published May 11, 2020 · Updated Aug 11, 2026 · Revision 15 · de-DE

Vendor: IBM Vendor: Red Hat Vendor: Ubuntu Product: Enterprise Linux Product: InfoSphere Information Server Product: JBoss Enterprise Application Platform Product: Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsvorkehrungen zu umgehen, einen Cross-Site-Angriff durchzuführen, einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen oder Dateien zu manipulieren.

Product

JBoss Enterprise Application Platform ist eine skalierbare Plattform für Java-Anwendungen, inklusive JBoss Application Server, JBoss Hibernate und Boss Seam.

Vulnerabilities 12

  • Critical 9.8
    CVE-2016-3720

    jackson-dataformat-xml vulnerable to XML external entity (XXE)

    XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.

    com.fasterxml.jackson.dataformat:jackson-dataformat-xml jackson-dataformat-xml jackson-dataformat-xml Debian Ubuntu Maven
  • High 8.6
    CVE-2020-1745

    Improper Authorization in Undertoe

    A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability …

    undertow-io undertow undertow undertow Debian Ubuntu Maven
  • High 8.1
    CVE-2020-1757

    Improper Input Validation in Undertow

    A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet container causes servletPath to normalize incorrectly by truncating the path afte…

    Red Hat undertow undertow undertow Debian Ubuntu Maven
  • High 7.5
    CVE-2019-12423

    Private key leak in Apache CXF

    Apache CXF ships with a OpenId Connect JWK Keys service, which allows a client to obtain the public keys in JWK format, which can then be used to verify the signature of tokens issued by the service. Typically, the service obtains the public key from a local …

    Apache CXF org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven
  • High 7.5
    CVE-2020-10705

    Allocation of Resources Without Limits or Throttling in Undertow

    A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  • High 7.5
    CVE-2020-7226

    Denial of Service in Cryptacular

    CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to trigger excessive memory allocation during a decode operation, because the nonce array length associated with "new byte" may depend on untrusted input wi…

    org.cryptacular:cryptacular Maven
  • Medium 6.5
    CVE-2020-10719

    HTTP Request Smuggling in Undertow

    A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.

    Red Hat undertow undertow undertow Debian Ubuntu Maven
  • Medium 6.1
    CVE-2019-17573 Public exploit

    Reflected Cross-Site Scripting in Apache CXF

    By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting (XSS) attack, which allows a malicious actor to inject javascript into the web p…

    Apache CXF org.apache.cxf:cxf org.apache.cxf:apache-cxf Maven
  • Medium 5.9
    CVE-2019-10172 Public exploit EPSS 17%

    Improper Restriction of XML External Entity Reference in jackson-mapper-asl

    A flaw was found in org.codehaus.jackson:jackson-mapper-asl:1.9.x libraries. XML external entity vulnerabilities similar CVE-2016-3720 also affects codehaus jackson-mapper-asl libraries but in different classes.

    Red Hat jackson-mapper-asl tez spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven
  • Medium 5.4
    CVE-2020-1719

    Privilege Context Switching Error in wildlfy

    A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before wildfly 20.0.0.Final ar…

    org.wildfly.bom:wildfly Maven
  • Medium 4.2
    CVE-2020-1732

    A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security ident…

    Red Hat Soteria
  • Medium 4.0
    CVE-2020-1729

    Permissions bypass in SmallRye

    A flaw was found in SmallRye's API through version 1.6.1. The API can allow other code running within the application server to potentially obtain the ClassLoader, bypassing any permissions checks that should have been applied. The largest threat from this vu…

    io.smallrye.config:smallrye-config Maven

Revision history

  1. #15

    Neue Updates von IBM aufgenommen

  2. #14

    Neue Updates von Red Hat aufgenommen

  3. #13

    Neue Updates von Red Hat aufgenommen

  4. #12

    Neue Updates von Ubuntu aufgenommen

  5. #11

    Neue Updates von Red Hat aufgenommen

  6. #10

    Neue Updates von Red Hat aufgenommen

  7. #9

    Neue Updates von Red Hat aufgenommen

  8. #8

    Neue Updates von Red Hat aufgenommen

  9. #7

    Neue Updates von Red Hat aufgenommen

  10. #6

    Neue Updates von Red Hat aufgenommen

  11. #5

    Neue Updates von Red Hat aufgenommen

  12. #4

    Neue Updates von Red Hat aufgenommen

  13. #3

    Neue Updates von Red Hat aufgenommen

  14. #2

    Neue Updates von Red Hat aufgenommen

  15. #1

    Initiale Fassung

References