Most recent entries from all

bdu:2020-04803

cnvd-2020-03215

EUVD-2026-49787

fkie_cve-2019-3888

A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)

GHSA-jwgx-9mmh-684w — Credential exposure through log files in Undertow

Affected: Maven: io.undertow:undertow-core

gsd-2019-3888

OESA-2021-1422 — undertow security update

Affected: openEuler:20.03-LTS-SP1: undertow, openEuler:20.03-LTS-SP2: undertow

Java web server using non-blocking IO Security Fix(es): A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)(CVE-2019-3888) A flaw was discovered in Undertow in versions before Undertow 2.1.1.Final where certain requests to the "Expect: 100-continue" header may cause an out of memory error. This flaw may potentially lead to a denial of service.(CVE-2020-10705) A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.(CVE-2020-10719)

RHSA-2019:1419 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.2 on RHEL 6 security update

picketlink: reflected XSS in SAMLRequest via RelayState parameter picketlink: URL injection via xinclude parameter undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed

UBUNTU-CVE-2019-3888

Affected: Ubuntu:Pro:16.04:LTS: undertow, Ubuntu:Pro:18.04:LTS: undertow, Ubuntu:20.04:LTS: undertow, Ubuntu:Pro:24.04:LTS: undertow, Ubuntu:25.10: undertow, Ubuntu:26.04:LTS: undertow

WID-SEC-W-2022-1947 — Red Hat Single Sign On: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Red Hat Single Sign On ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, einen Denial of Service Zustand hervorzurufen, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen oder beliebigen Programmcode auszuführen.