[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFN7U4WCaol0yoSqwAyIllMtHm78wSn4Cf_1gKcTzupA":3,"g5a-family:redhat\u002Fjboss_enterprise_web_server":145,"g5a-ex:redhat\u002Fjboss_enterprise_web_server@*":148},{"success":4,"data":5},true,{"product":6,"versions":38,"topVulnerabilitiesByEpss":47,"kevVulnerabilities":111,"seoMetadata":123,"meta":142},{"vendorName":7,"productName":8,"versionCount":9,"totalCves":10,"kevCount":11,"lastCveUpdate":12,"versions":13,"description":37},"redhat","jboss_enterprise_web_server",8,36,3,"2021-05-28",[14,19,21,24,27,30,32,35],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},"1.0.0",13,0,false,{"version":20,"cve_count":17,"kev_count":17,"has_kev":18},"1.0.1",{"version":22,"cve_count":23,"kev_count":17,"has_kev":18},"1.0.2",2,{"version":25,"cve_count":26,"kev_count":23,"has_kev":4},"2.0.0",11,{"version":28,"cve_count":29,"kev_count":17,"has_kev":18},"2.0.1",1,{"version":31,"cve_count":29,"kev_count":17,"has_kev":18},"2.1",{"version":33,"cve_count":34,"kev_count":11,"has_kev":4},"3.0.0",14,{"version":36,"cve_count":23,"kev_count":17,"has_kev":18},"5.0.0","Jboss Enterprise Web Server by Redhat is a technology product with 8 tracked versions and 36 known security vulnerabilities including 3 CISA Known Exploited Vulnerabilities. Get comprehensive security analysis, vulnerability tracking, and threat intelligence for this product.",[39,40,41,42,43,44,45,46],{"version":15,"cve_count":16,"kev_count":17,"has_kev":18},{"version":20,"cve_count":17,"kev_count":17,"has_kev":18},{"version":22,"cve_count":23,"kev_count":17,"has_kev":18},{"version":25,"cve_count":26,"kev_count":23,"has_kev":4},{"version":28,"cve_count":29,"kev_count":17,"has_kev":18},{"version":31,"cve_count":29,"kev_count":17,"has_kev":18},{"version":33,"cve_count":34,"kev_count":11,"has_kev":4},{"version":36,"cve_count":23,"kev_count":17,"has_kev":18},[48,56,61,67,73,80,85,91,99,105],{"cveId":49,"description":50,"publishedDate":51,"cvssScore":52,"cvssVersion":53,"severity":54,"isKev":4,"epssScore":55},"CVE-2017-12617","When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default servlet to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-10-04",8.1,"v3.1","High",0.99988,{"cveId":57,"description":58,"publishedDate":59,"cvssScore":52,"cvssVersion":53,"severity":54,"isKev":4,"epssScore":60},"CVE-2017-12615","When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.","2017-09-19",0.99607,{"cveId":62,"description":63,"publishedDate":64,"cvssScore":65,"cvssVersion":53,"severity":54,"isKev":18,"epssScore":66},"CVE-2016-2183","The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack.","2016-09-01",7.5,0.95707,{"cveId":68,"description":69,"publishedDate":70,"cvssScore":71,"cvssVersion":53,"severity":54,"isKev":18,"epssScore":72},"CVE-2014-0224","OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCipherSpec messages, which allows man-in-the-middle attackers to trigger use of a zero-length master key in certain OpenSSL-to-OpenSSL communications, and consequently hijack sessions or obtain sensitive information, via a crafted TLS handshake, aka the \"CCS Injection\" vulnerability.","2014-06-05",7.4,0.95326,{"cveId":74,"description":75,"publishedDate":76,"cvssScore":77,"cvssVersion":53,"severity":78,"isKev":4,"epssScore":79},"CVE-2016-8735","Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.","2017-04-06",9.8,"Critical",0.90338,{"cveId":81,"description":82,"publishedDate":83,"cvssScore":77,"cvssVersion":53,"severity":78,"isKev":18,"epssScore":84},"CVE-2011-3923","Apache Struts before 2.3.1.2 allows remote attackers to bypass security protections in the ParameterInterceptor class and execute arbitrary commands.","2019-11-01",0.88829,{"cveId":86,"description":87,"publishedDate":88,"cvssScore":77,"cvssVersion":89,"severity":78,"isKev":18,"epssScore":90},"CVE-2015-7501","Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform (SOA-P) 5.x; Web Server (JWS) 3.x; Red Hat OpenShift\u002FxPAAS 3.x; and Red Hat Subscription Asset Manager 1.3 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.","2017-11-09","v3.0",0.83274,{"cveId":92,"description":93,"publishedDate":94,"cvssScore":95,"cvssVersion":96,"severity":97,"isKev":18,"epssScore":98},"CVE-2012-0053","protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2) malformed header in conjunction with crafted web script.","2012-01-28",4.3,"v2","Medium",0.82756,{"cveId":100,"description":101,"publishedDate":102,"cvssScore":103,"cvssVersion":96,"severity":97,"isKev":18,"epssScore":104},"CVE-2013-5704","The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass \"RequestHeader unset\" directives by placing a header in the trailer portion of data sent with chunked transfer coding.  NOTE: the vendor states \"this is not a security issue in httpd as such.\"","2014-04-15",5,0.60205,{"cveId":106,"description":107,"publishedDate":108,"cvssScore":109,"cvssVersion":89,"severity":78,"isKev":18,"epssScore":110},"CVE-2017-9788","In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. Providing an initial key with no '=' assignment could reflect the stale value of uninitialized pool memory used by the prior request, leading to leakage of potentially confidential information, and a segfault in other cases resulting in denial of service.","2017-07-13",9.1,0.5677,[112,117,121],{"cveId":74,"description":75,"publishedDate":76,"cvssScore":77,"severity":78,"isKev":4,"epssScore":79,"cisaVulnName":113,"cisaDateAdded":114,"cisaShortDescription":115,"cisaRequiredAction":116},"Apache Tomcat Remote Code Execution Vulnerability","2023-05-12","Apache Tomcat contains an unspecified vulnerability that allows for remote code execution if JmxRemoteLifecycleListener is used and an attacker can reach Java Management Extension (JMX) ports. This CVE exists because this listener wasn't updated for consistency with the Oracle patched issues for CVE-2016-3427 which affected credential types.","Apply updates per vendor instructions.",{"cveId":57,"description":58,"publishedDate":59,"cvssScore":52,"severity":54,"isKev":4,"epssScore":60,"cisaVulnName":118,"cisaDateAdded":119,"cisaShortDescription":120,"cisaRequiredAction":116},"Apache Tomcat on Windows Remote Code Execution Vulnerability","2022-03-25","When running Apache Tomcat on Windows with HTTP PUTs enabled, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"cveId":49,"description":50,"publishedDate":51,"cvssScore":52,"severity":54,"isKev":4,"epssScore":55,"cisaVulnName":113,"cisaDateAdded":119,"cisaShortDescription":122,"cisaRequiredAction":116},"When running Apache Tomcat, it is possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.",{"title":124,"metaDescription":125,"keywords":126,"structuredData":127},"Jboss Enterprise Web Server by Redhat - Security Vulnerabilities & Analysis | EdgeProtect","Comprehensive security analysis for Jboss Enterprise Web Server by Redhat covering 8 versions with 36 tracked vulnerabilities including 1 critical and 2 high-severity issues and 3 CISA KEV vulnerabilities. Real-time threat intelligence, CVE tracking, and security recommendations.","Jboss Enterprise Web Server vulnerabilities, Jboss Enterprise Web Server security, Jboss Enterprise Web Server CVE, Redhat Jboss Enterprise Web Server, Jboss Enterprise Web Server threat intelligence, Redhat security, product security analysis, cybersecurity threats, vulnerability management, CVE tracking, Jboss Enterprise Web Server KEV, Jboss Enterprise Web Server exploited vulnerabilities",{"@context":128,"@type":129,"name":130,"description":125,"url":131,"manufacturer":132,"applicationCategory":136,"softwareVersion":137,"mainEntity":138},"https:\u002F\u002Fschema.org","SoftwareApplication","Jboss Enterprise Web Server","https:\u002F\u002Fedgeprotect.io\u002Fvulnerabilities\u002Ftechnologies\u002Fvendors\u002Fredhat\u002Fjboss_enterprise_web_server",{"@type":133,"name":134,"url":135},"Organization","Redhat","https:\u002F\u002Fedgeprotect.io\u002Fvendors\u002Fredhat","Security Software","8 versions tracked",{"@type":139,"name":140,"description":141,"vulnerabilityCount":10,"dateModified":12},"SecurityVulnerability","Jboss Enterprise Web Server Security Vulnerabilities","Security vulnerabilities affecting Jboss Enterprise Web Server by Redhat",{"totalVersions":9,"totalVulnerabilities":10,"kevVulnerabilities":11,"lastUpdated":12,"generatedAt":143,"apiVersion":144},"2026-10-28T17:13:42.462Z","3.0",[146],{"product":147,"cves":23},"jboss_enterprise_web_server_text-only_advisories",{"rows":149,"total":11,"capped":18,"failed":17},[150,154,158],{"cveId":74,"name":113,"severity":78,"cvss":77,"added":114,"epss":79,"published":151,"ranges":152,"checked":4,"hits":153,"covers":18},"2017-04-06T21:59:00.243",[33],[],{"cveId":57,"name":118,"severity":54,"cvss":52,"added":119,"epss":60,"published":155,"ranges":156,"checked":4,"hits":157,"covers":18},"2017-09-19T13:29:00.19",[25,33],[],{"cveId":49,"name":113,"severity":54,"cvss":52,"added":119,"epss":55,"published":159,"ranges":160,"checked":4,"hits":161,"covers":18},"2017-10-04T01:29:02.12",[25,33],[]]