https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:18:10 +0000 https://cve.radiocsirt.org/vuln/cnvd-2018-04365 cnvd-2018-04365 https://cve.radiocsirt.org/vuln/cnvd-2018-04365 https://cve.radiocsirt.org/vuln/euvd-2026-60991 EUVD-2026-60991 https://cve.radiocsirt.org/vuln/euvd-2026-60991 https://cve.radiocsirt.org/vuln/fkie_cve-2018-1048 <p>It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.</p> <p>It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-1048 https://cve.radiocsirt.org/vuln/ghsa-prfw-3qx6-g9xr <p><strong>Affected:</strong> Maven: org.jboss.eap:wildfly-undertow</p> <p>It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.</p> <p><strong>Affected:</strong> Maven: org.jboss.eap:wildfly-undertow</p> <p>It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.</p> https://cve.radiocsirt.org/vuln/ghsa-prfw-3qx6-g9xr https://cve.radiocsirt.org/vuln/gsd-2018-1048 gsd-2018-1048 https://cve.radiocsirt.org/vuln/gsd-2018-1048 https://cve.radiocsirt.org/vuln/rhsa-2018:0478 <p>resteasy: Vary header not added by CORS filter leading to cache poisoning artemis/hornetq: memory exhaustion via UDP and JGroups discovery undertow: Client can use bogus uri in Digest authentication infinispan: Unsafe deserialization of malicious object injected into data cache jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)</p> <p>resteasy: Vary header not added by CORS filter leading to cache poisoning artemis/hornetq: memory exhaustion via UDP and JGroups discovery undertow: Client can use bogus uri in Digest authentication infinispan: Unsafe deserialization of malicious object injected into data cache jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)</p> https://cve.radiocsirt.org/vuln/rhsa-2018:0478 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-1048 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: undertow, Ubuntu:Pro:18.04:LTS: undertow, Ubuntu:Pro:20.04:LTS: undertow, Ubuntu:Pro:22.04:LTS: undertow, Ubuntu:Pro:24.04:LTS: undertow, Ubuntu:25.10: undertow, Ubuntu:26.04:LTS: undertow</p> <p>It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: undertow, Ubuntu:Pro:18.04:LTS: undertow, Ubuntu:Pro:20.04:LTS: undertow, Ubuntu:Pro:22.04:LTS: undertow, Ubuntu:Pro:24.04:LTS: undertow, Ubuntu:25.10: undertow, Ubuntu:26.04:LTS: undertow</p> <p>It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the information disclosure of arbitrary local files.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-1048 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2753 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten offenzulegen, Sicherheitsrestriktionen zu umgehen oder Code zur Ausführung zu bringen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise Application Platform ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten offenzulegen, Sicherheitsrestriktionen zu umgehen oder Code zur Ausführung zu bringen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2753