Wildfly
18 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-2251 | < 36.0.0 | Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code execution | MEDIUM 6.2 | 1.1 % | ||
| CVE-2024-12369 | ≤ 34.0.1.Final | Elytron-oidc-client: oidc authorization code injection | MEDIUM 4.2 | 0.2 % | ||
| CVE-2024-10234 | 35.0.0 – < 35.0.0 | Wildfly: wildfly vulnerable to cross-site scripting (xss) | HIGH 7.3 | 0.7 % | ||
| CVE-2024-4029 | < 24.0.1.Final | Wildfly: no timeout for eap management interface may lead to denial of service (dos) | MEDIUM 4.1 | 0.3 % | ||
| CVE-2024-1233 | < 32.0.0.Final | Eap: wildfly-elytron has a ssrf security issue | HIGH 7.3 | 0.8 % | ||
| CVE-2022-1278 | no fixed versions known | A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain. | HIGH 7.5 | 0.9 % | ||
| CVE-2021-3717 | wildfly-core 17.0 | A flaw was found in Wildfly. An incorrect JBOSS_LOCAL_USER challenge location when using the elytron configuration may lead to JBOSS_LOCAL_U | HIGH 7.8 | 0.3 % | ||
| CVE-2022-0866 | JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled. | This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configur | MEDIUM 5.3 | 0.9 % | ||
| CVE-2021-3503 | Fixed in 23.0.1.Final | A flaw was found in Wildfly where insufficient RBAC restrictions may lead to expose metrics data. The highest threat from this vulnerability | MEDIUM 4.3 | 1.1 % | ||
| CVE-2020-1719 | wildfly 20.0.0.Final | A flaw was found in wildfly. The EJBContext principle is not popped back after invoking another EJB using a different Security Domain. The h | MEDIUM 5.4 | 0.6 % | ||
| CVE-2020-14317 | will not be fixed | It was found that the issue for security flaw CVE-2019-3805 appeared again in a further version of JBoss Enterprise Application Platform - C | MEDIUM 5.5 | 0.2 % | ||
| CVE-2021-3536 | Wildfly 23.0.2.Final | A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible t | MEDIUM 4.8 | 0.5 % | ||
| CVE-2021-20250 | jboss-ejb-client 4.0.39 | A flaw was found in wildfly. The JBoss EJB client has publicly accessible privileged actions which may lead to information disclosure on the | MEDIUM 4.3 | 0.7 % | ||
| CVE-2020-27822 | 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, 21.0.0.Final | A flaw was found in Wildfly affecting versions 19.0.0.Final, 19.1.0.Final, 20.0.0.Final, 20.0.1.Final, and 21.0.0.Final. When an application | MEDIUM 5.9 | 1.1 % | ||
| CVE-2020-25640 | Wildfly 21.0.0.Final | A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection err | MEDIUM 5.3 | 1.3 % | ||
| CVE-2020-14338 | All xerces jboss versions before 2.12.0.SP3 | A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfl | MEDIUM 5.3 | 1.3 % | ||
| CVE-2020-10718 | before wildfly-embedded-13.0.0.Final | A flaw was found in Wildfly before wildfly-embedded-13.0.0.Final, where the embedded managed process API has an exposed setting of the Threa | HIGH 7.5 | 1.4 % | ||
| CVE-2020-1748 | before wildfly-elytron-1.6.8.Final-redhat-00001 | A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were byp | HIGH 7.5 | 1.4 % |