CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Red Hat RichFaces 3.X Expression Language (EL) Injection and Remote Code Execution (RCE) Vulnerability (CVE-2018-14667)
[Affected Scope] All Java-based web applications utilizing RichFaces Framework versions 3.0.0 through 3.3.4.
[Impact] A remote, unauthenticated attacker can execute arbitrary system commands and fully compromise the host by sending a crafted chain of serialized Java objects.
[Mitigation] Migrate legacy RichFaces 3.X applications to supported frameworks, or restrict external access to the vulnerable '/org.ajax4jsf.resource.UserResource' path using WAF rules or servlet filters.
Red Hat JBoss EAP Web Console HTTP Verb Tampering Information Disclosure (CVE-2010-1428)
[Affected Scope] Red Hat JBoss Enterprise Application Platform (JBoss EAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08.
[Impact] Remote attackers can bypass authentication and access sensitive administrative information within the Web Console by utilizing non-standard HTTP methods (such as HEAD or PUT).
[Mitigation] Apply the official Cumulative Patch (CP) or modify the web.xml configuration to enforce authentication across all HTTP methods.