CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Red Hat RichFaces 3.X Expression Language (EL) Injection and Remote Code Execution (RCE) Vulnerability (CVE-2018-14667)
[Affected Scope] All Java-based web applications utilizing RichFaces Framework versions 3.0.0 through 3.3.4.
[Impact] A remote, unauthenticated attacker can execute arbitrary system commands and fully compromise the host by sending a crafted chain of serialized Java objects.
[Mitigation] Migrate legacy RichFaces 3.X applications to supported frameworks, or restrict external access to the vulnerable '/org.ajax4jsf.resource.UserResource' path using WAF rules or servlet filters.
Red Hat JBoss Application Server HTTP Invoker Deserialization Remote Code Execution (RCE) Vulnerability (CVE-2017-12149) Analysis and Mitigation Guide
[Affected Scope] JBoss Application Server shipped with Red Hat Enterprise Application Platform (EAP) 5.2, specifically when the HTTP Invoker (ReadOnlyAccessFilter) is enabled.
[Impact] Unauthenticated remote attackers can execute arbitrary OS commands with the privileges of the JBoss process by sending crafted serialized Java objects.
[Mitigation] Apply official Red Hat security updates, disable or restrict access to the HTTP Invoker servlet, or block serialization payloads using a Web Application Firewall (WAF).