CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 19/12/2019 |
| CVE-2014-3701 | HOCH8.1 | eDeploy has tmp file race condition flaws | 15/12/2019 |
| CVE-2014-3699 | KRITISCH9.8 | eDeploy has RCE via cPickle deserialization of untrusted data | 15/12/2019 |
| CVE-2012-2148 | NIEDRIG3.3 | An issue exists in the property replacements feature in any descriptor in JBoxx AS 7.1.1 ignores java security policies | 06/12/2019 |
| CVE-2014-3700 | KRITISCH9.8 | eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data | 21/11/2019 |
| CVE-2014-3655 | MITTEL4.3 | JBoss KeyCloak is vulnerable to soft token deletion via CSRF | 13/11/2019 |
| CVE-2011-3923 | KRITISCH9.8 | Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands. | 01/11/2019 |
| CVE-2019-1559 | MITTEL5.9 | If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MA | 27/02/2019 |
| CVE-2018-1336 | HOCH7.5 | An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service. Versions Affected: Apache Tomcat 9.0.0.M9 to 9.0.7, 8.5.0 to 8.5.30, 8.0.0.RC1 to 8.0.51, and 7.0.28 to 7.0.86. | 02/08/2018 |
| CVE-2018-1304 | MITTEL5.9 | The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This caused the constraint to be ignored. It was, therefore, possi | 28/02/2018 |
| CVE-2015-7501 | KRITISCH9.8 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat | 09/11/2017 |
| CVE-2017-12613 | HOCH7.1 | When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in | 24/10/2017 |
| CVE-2017-12617KEV | HOCH8.1 | When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP cou | 04/10/2017 |
| CVE-2015-5184 | HOCH7.5 | Console: CORS headers set to allow all in Red Hat AMQ. | 25/09/2017 |
| CVE-2015-5183 | HOCH7.5 | Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ. | 25/09/2017 |
| CVE-2017-12615KEV | HOCH8.1 | When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed b | 19/09/2017 |
| CVE-2016-6796 | HOCH7.5 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Servlet. | 11/08/2017 |
| CVE-2016-6797 | HOCH7.5 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web applicati | 10/08/2017 |