title: Red Hat Security Advisory: EAP Continuous Delivery Technical Preview Release 20 security update
description: mojarra: Path traversal in ResourceManager.java:getLocalePrefix() via the loc parameter jackson-mapper-asl: XML external entity similar to CVE-2016-3720 hibernate: SQL injection issue in Hibernate ORM Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain cxf: JMX integration is vulnerable to a MITM attack Mojarra: Path traversal via either the loc parameter or the con parameter, incomplete fix of CVE-2018-14371 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution dom4j: XML External Entity vulnerability in default SAX parser undertow: Memory exhaustion issue in HttpReadListener via "Expect: 100-continue" header wildfly-elytron: session fixation when using FORM authentication undertow: invalid HTTP request with large chunk size wildfly: unsafe deserialization in Wildfly Enterprise Java Beans netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
cpes: cpe:/a:redhat:jboss_enterprise_application_platform_cd:20