Advisories · Technology
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10.
Every CVE that names Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.2 Medium
Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2
- Red Hat JBoss Enterprise Application Platform 8.1.8.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- Authentication bypass
- CVSS 5.9 Medium
Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload
- Red Hat JBoss Enterprise Application Platform 8.1.8.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- Denial of service
- CVSS 8.8 High
Artemis-server: artemis-jms-client: artemis-core-client: undertow-core: wildfly-messaging-activemq-subsystem: artemis messaging handlers in red hat eap permit deserialization by default
- Red Hat JBoss Enterprise Application Platform 8.1.8.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- Insecure deserialization
- CVSS 7.5 High
Undertow-core: undertow: denial of service via websocket permessage-deflate processing
- Red Hat JBoss Enterprise Application Platform 8.1.8.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- Denial of service
- CVSS 5.3 Medium
Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap
- Red Hat JBoss Enterprise Application Platform 8.1.8.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- HTTP request smuggling
- CVSS 7.5 High
Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener
- Red Hat JBoss Enterprise Application Platform 7.4.25
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- Denial of service
- CVSS 7.5 High
Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method
- Red Hat JBoss Enterprise Application Platform 7.4.25
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- Memory corruption
- CVSS 7.4 High
Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos
- Red Hat JBoss Enterprise Application Platform 7.4.25
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- Authentication bypass
- CVSS 7.5 High
Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service
- Red Hat JBoss Enterprise Application Platform 7.4.25
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- Memory corruption
- CVSS 7.5 High
Undertow-core: oom via missing limits in chunked trailer in eap's undertow
- Red Hat JBoss Enterprise Application Platform 7.4.25
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- Denial of service
- CVSS 8.1 High
Openjdk-orb: unauthed class loading via iiop in eap
- Red Hat JBoss Enterprise Application Platform 7.4.25
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- CWE-829
- CVSS 8.8 High
Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
- Red Hat JBoss Enterprise Application Platform 7.4.25
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- Insecure deserialization
- CVSS 7.4 High
Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery
- Red Hat JBoss Enterprise Application Platform 7.4.25
- Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7
- Weak cryptography or TLS
- CVSS 6.5 Medium
Jastow: jastow cross-site scripting attack due to unsanitized uri
- Red Hat JBoss Enterprise Application Platform 8.1.7.GA
- Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
- Cross-site scripting (XSS)