Approved changes feed: RSS · Atom
cpe:2.3:a:red_hat:wildfly:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Red Hat (a3686528-5679-55c9-b393-abe45df26bd2) |
|---|---|
| Product | Wildfly (b30cc49c-5706-5c91-b3dc-fcf140ffb29c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-14307 |
vulnerable | 2026-06-08 05:19:22.924059 |
Details available
MEDIUM (6.5)
A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote InvocationTracker after a response is received in the EJB Client, as well as the server. This flaw allows an attacker to craft a denial of service attack to make the service unavailable.
Published: 2020-07-24T00:00:00.000Z
Updated: 2024-08-04T12:39:36.215Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-14297 |
vulnerable | 2026-06-08 05:19:22.854135 |
Details available
MEDIUM (6.5)
A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause services to slow down and eventaully unavailable. An attacker can take advantage and cause denial of service attack and make services unavailable.
Published: 2020-07-24T15:37:25.000Z
Updated: 2024-10-15T17:14:53.962Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-3894 |
vulnerable | 2026-06-08 05:13:56.321977 |
Details available
MEDIUM (5.4)
It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These threads do not necessarily terminate if the keep alive time has not expired. This could allow a shared thread to use the wrong security identity when executing.
Published: 2019-05-03T19:25:58.000Z
Updated: 2024-08-04T19:19:18.806Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-3805 |
vulnerable | 2026-06-08 05:13:56.066280 |
Details available
MEDIUM (5.5)
A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root.
Published: 2019-05-03T19:25:28.000Z
Updated: 2024-08-04T19:19:18.533Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-14887 |
vulnerable | 2026-06-08 05:12:56.342975 |
Details available
HIGH (7.4)
A flaw was found when an OpenSSL security provider is used with Wildfly, the 'enabled-protocols' value in the Wildfly configuration isn't honored. An attacker could target the traffic sent from Wildfly and downgrade the connection to a weaker version of TLS, potentially breaking the encryption. This could lead to a leak of the data being passed over the network. Wildfly version 7.2.0.GA, 7.2.3.GA and 7.2.5.CR2 are believed to be vulnerable.
Published: 2020-03-16T14:48:09.000Z
Updated: 2024-08-05T00:26:39.145Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.