Skip to content
Noroxi

jboss records

14 published records for vendor jboss.

Researcher profile

Entered KEV
0 · 0%
Weaponized
2 · 14.3%
Pre-auth RCE
4
With a fix record
50%
Median publish → KEV
No record has entered KEV

Records by year

  1. 18

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

14 records
  • CVE-2007-1036
    55Plan

    The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attack

    HighCVSS 7.5WeaponizedEPSS 82%

    jboss · jboss application serverFeb 21, 2007

  • CVE-2008-3273
    40Plan

    JBoss Enterprise Application Platform (aka JBossEAP or EAP) before 4.2.0.CP03, and 4.3.0 before 4.3.0.CP01, allows remote attackers to obtai

    MediumCVSS 5.0WeaponizedEPSS 47%

    jboss · enterprise application platformAug 10, 2008

  • CVE-2018-1041
    35Monitor

    A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer.

    HighCVSS 7.5Proof of conceptEPSS 15%

    jboss · jboss-remotingFeb 15, 2018

  • CVE-2003-0845
    35Monitor

    Unknown vulnerability in the HSQLDB component in JBoss 3.2.1 and 3.0.8 on Java 1.4.x platforms, when running in the default configuration, a

    HighCVSS 7.5Proof of conceptEPSS 15%

    jboss · jbossNov 17, 2003

  • CVE-2006-5750
    34Monitor

    Directory traversal vulnerability in the DeploymentFileRepository class in JBoss Application Server (jbossas) 3.2.4 through 4.0.5 allows rem

    HighCVSS 7.5No exploitEPSS 14%

    jboss · jboss application serverNov 27, 2006

  • CVE-2007-6433
    31Monitor

    The getRenderedEjbql method in the org.jboss.seam.framework.Query class in JBoss Seam 2.x before 2.0.0.CR3 allows remote attackers to inject

    HighCVSS 7.5No exploitEPSS 3%

    jboss · seamDec 18, 2007

  • CVE-2016-2094
    31Monitor

    The HTTPS NIO Connector allows remote attackers to cause a denial of service (thread consumption) by opening a socket and not sending an SSL

    HighCVSS 7.5No exploitEPSS 2%

    jboss · enterprise application platformMay 6, 2016

  • CVE-2005-2158
    30Monitor

    A regression error in the embedded HSQLDB in JBoss jBPM 2.0 allows remote attackers to execute arbitrary comands, a re-introduction of a vul

    HighCVSS 7.5No exploitEPSS 1%

    jboss · jbpmJul 6, 2005

  • CVE-2007-1157
    30Monitor

    Cross-site request forgery (CSRF) vulnerability in jmx-console/HtmlAdaptor in JBoss allows remote attackers to perform privileged actions as

    HighCVSS 7.6No exploitEPSS 0%

    jboss · jbossMar 2, 2007

  • CVE-2007-1354
    24Monitor

    The Access Control functionality (JMXOpsAccessControlFilter) in JMX Console in JBoss Application Server 4.0.2 and 4.0.5 before 20070416 uses

    MediumCVSS 6.0No exploitEPSS 1%

    jboss · jboss application serverJul 27, 2007

  • CVE-2005-2006
    23Monitor

    JBOSS 3.2.2 through 3.2.7 and 4.0.2 allows remote attackers to obtain sensitive information via a GET request (1) with a "%." (percent dot),

    MediumCVSS 5.0Proof of conceptEPSS 9%

    jboss · jbossJun 17, 2005

  • CVE-2005-4709
    21Monitor

    The popSubjectContext method in the SecurityAssociation class in JBoss Enterprise Java Beans (EJB) 3.0 RC3 maintains the threadPrincipal and

    MediumCVSS 5.0No exploitEPSS 2%

    jboss · enterprise java beansDec 31, 2005

  • CVE-2014-0170
    18Monitor

    Teiid before 8.4.3 and before 8.7 and Red Hat JBoss Data Virtualization 6.0.0 before patch 3 allows remote attackers to read arbitrary files

    MediumCVSS 4.3No exploitEPSS 1%

    jboss · teiidSep 30, 2014

  • CVE-2012-3428
    17Monitor

    The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a secur

    MediumCVSS 4.3No exploitEPSS 1%

    jboss · ironjacamarDec 20, 2012