Most recent entries from all

bdu:2021-04259

EUVD-2026-20949

fkie_cve-2021-3642

A flaw was found in Wildfly Elytron in versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality.

GHSA-5499-qjvh-6j7w — Observable Discrepancy in Wildfly Elytron

Affected: Maven: org.wildfly.security:wildfly-elytron

A flaw was found in Wildfly Elytron where ScramServer may be susceptible to Timing Attack if enabled. The highest threat of this vulnerability is confidentiality. This flaw affectes Wildfly Elytron versions prior to 1.10.14.Final, prior to 1.15.5.Final and prior to 1.16.1.Final.

gsd-2021-3642

RHSA-2021:3656 — Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.1 security update on RHEL 7

velocity: arbitrary code execution when attacker is able to modify templates wildfly: XSS via admin console when creating roles in domain mode undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS wildfly-elytron: possible timing attack in ScramServer wildfly-core: Invalid Sensitivity Classification of Vault Expression undertow: buffer leak on incoming websocket PONG message may lead to DoS netty: possible request smuggling in HTTP/2 due missing validation netty: Request smuggling via content-length header jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6

WID-SEC-W-2022-0607 — Red Hat FUSE: Mehrere Schwachstellen

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.