Redhat Integration Service Registry vulnerabilities
7 vulnerabilities
Known vulnerabilities in Redhat Integration Service Registry, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2021-3536org.wildflywildfly-parent+9
EPSS score0.53%
A flaw was found in Wildfly in versions before 23.0.2.Final while creating a new role in domain mode via the admin console, it is possible to add a payload in the name field, leading to XSS. This affects Confidentiality and Integrity.CVE-2022-1278org.wildfly.bomwildfly+8EPSS score0.86%
A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain.CVE-2022-41862alpinepostgresql+101EPSS score0.62%
In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes.CVE-2022-4492debianundertow+12EPSS score0.60%
The undertow client is not checking the server identity presented by the server certificate in https connections. This is a compulsory step (at least it should be performed by default) in https and in http/2. I would add it to any TLS client protocol.CVE-2023-1108debianundertow+24EPSS score1.77%
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.CVE-2023-4853io.quarkusquarkus-csrf-reactive+16EPSS score1.45%
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized endpoint access and possibly a denial of service.CVE-2023-44487akkahttp_server+704KEVEPSS score100.00%
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.