Red Hat Jboss Data Grid Text-only Edition

CPE Details

Red Hat Jboss Data Grid Text-only Edition
redhat
jboss_data_grid
-
2020-09-17
11h24 +00:00
2021-08-17
12h41 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:redhat:jboss_data_grid:-:*:*:*:text-only:*:*:*

Informations

Vendor

redhat

Product

jboss_data_grid

Version

-

Software Edition

text-only

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2023-5384 2023-12-18 13h43 +00:00 A flaw was found in Infinispan. When serializing the configuration for a cache to XML/JSON/YAML, which contains credentials (JDBC store with connection pooling, remote store), the credentials are returned in clear text as part of the configuration.
7.2
Haute
CVE-2023-5236 2023-12-18 13h43 +00:00 A flaw was found in Infinispan, which does not detect circular object references when unmarshalling. An authenticated attacker with sufficient permissions could insert a maliciously constructed object into the cache and use it to cause out of memory errors and achieve a denial of service.
6.5
Moyen
CVE-2023-3629 2023-12-18 13h43 +00:00 A flaw was found in Infinispan's REST, Cache retrieval endpoints do not properly evaluate the necessary admin permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
6.5
Moyen
CVE-2023-3628 2023-12-18 13h43 +00:00 A flaw was found in Infinispan's REST. Bulk read endpoints do not properly evaluate user permissions for the operation. This issue could allow an authenticated user to access information outside of their intended permissions.
6.5
Moyen
CVE-2020-1710 2020-09-16 12h28 +00:00 The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400.
5.3
Moyen
CVE-2019-14892 2020-03-02 15h28 +00:00 A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.
9.8
Critique
CVE-2019-14888 2020-01-23 15h25 +00:00 A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.
7.5
Haute
CVE-2019-10174 2019-11-25 09h26 +00:00 A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the application.
8.8
Haute
CVE-2019-10219 2019-11-08 13h46 +00:00 A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.
6.1
Moyen
CVE-2019-10212 2019-10-02 16h22 +00:00 A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.
9.8
Critique
CVE-2019-10184 2019-07-25 18h35 +00:00 undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
7.5
Haute
CVE-2019-3888 2019-06-12 11h45 +00:00 A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)
9.8
Critique