Jboss Enterprise Application Platform
Approved changes feed: RSS · Atom
cpe:2.3:a:redhat:jboss_enterprise_application_platform:8.0.0:*:*:*:*:*:*:*
part: a version: 8.0.0 update: *
| Vendor | Redhat (e942785a-ca89-506e-bd99-50782639cde3) |
|---|---|
| Product | Jboss Enterprise Application Platform (1fae2c77-9ea1-5c62-8727-311c31afda6c) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-4874 |
vulnerable | 2026-06-08 08:07:02.571446 |
Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation
LOW (3.1)
A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to use the `backchannel.logout.url` with the `application.session.host` placeholder. Successful exploitation allows the attacker to make HTTP requests from the Keycloak server’s network context, potentially probing internal networks or internal APIs, leading to information disclosure.
Published: 2026-03-26T07:12:37.545Z
Updated: 2026-06-26T07:01:28.059Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-4366 |
vulnerable | 2026-06-08 08:05:13.289353 |
Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak
MEDIUM (5.8)
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.
Published: 2026-03-18T04:02:59.959Z
Updated: 2026-06-09T16:36:05.369Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3260 |
vulnerable | 2026-06-08 08:01:18.280783 |
Details available
Published: 2026-03-24T04:11:16.085Z
Updated: 2026-07-07T19:50:22.087Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-3121 |
vulnerable | 2026-06-08 08:01:17.888005 |
Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission
MEDIUM (6.5)
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain control over roles, users, or other administrative functions within the realm. This privilege escalation can occur when admin permissions are enabled at the realm level.
Published: 2026-03-26T19:13:26.086Z
Updated: 2026-04-02T16:39:35.672Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28369 |
vulnerable | 2026-06-08 07:55:15.208368 |
Undertow: undertow: request smuggling via malformed http request headers
HIGH (8.7)
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform request smuggling. Request smuggling allows an attacker to bypass security mechanisms, access restricted information, or manipulate web caches, potentially leading to unauthorized actions or data exposure.
Published: 2026-03-27T16:13:05.719Z
Updated: 2026-07-22T05:35:33.436Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28368 |
vulnerable | 2026-06-08 07:55:15.203601 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28367 |
vulnerable | 2026-06-08 07:55:15.198580 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-9784 |
vulnerable | 2026-06-08 07:47:09.794680 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-5731 |
vulnerable | 2026-06-08 07:37:25.621573 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-23368 |
vulnerable | 2026-06-08 07:10:55.597822 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-7885 |
vulnerable | 2026-06-08 06:58:23.810579 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.