CVE-2011-4610

CVE-2011-4610 affects JBoss Web (used in Red Hat JBoss Communications Platform, Enterprise Web Platform, and Enterprise Application Platform) where a crafted UTF-8 surrogate pair at the boundary of an internal buffer can cause a denial of service (infinite loop). Connected advisories note Red Hat...

CVE-2012-3427

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

Adobe ColdFusion Unsupported Version Detection

According to its version, the installation of Adobe ColdFusion running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. %NASLMINLEVEL 70300...

Design/Logic Flaw

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar iss...

CVE-2013-2185

CVE-2013-2185 involves DiskFileItem in Apache Commons FileUpload used with Red Hat JBoss EAP 6.1.0 and JBoss Portal 6.0.0. The issue stems from deserialization of a serialized DiskFileItem where a NULL byte in a filename can let a remote attacker write to arbitrary files. The description notes a ...

remote-naming: Session fixation due improper connection caching

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

CVE-2013-4210

The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other products allows remote attackers to cause a denial of service file descriptor consumption via...

RHEL 4 / 5 / 6 : jboss-remoting (RHSA-2013:1369)

An updated jboss-remoting package that fixes one security issue is now available for Red Hat JBoss Enterprise Application Platform 5.2.0 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability...

Moderate: Red Hat Security Advisory: jboss-remoting security update

An update for the JBoss Remoting component of Red Hat JBoss Enterprise Application Platform 5.2.0 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability...

Moderate: Red Hat Security Advisory: jboss-remoting security update

An updated jboss-remoting package that fixes one security issue is now available for Red Hat JBoss Enterprise Application Platform 5.2.0 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability...

Input validation

PicketBox, as used in Red Hat JBoss Enterprise Application Platform before 6.1.1, allows local users to obtain the admin encryption key by reading the Vault data file...

Microsoft SharePoint 2013 - Persistent Web Vulnerability

Document Title: =============== Microsoft SharePoint 2013 - Persistent Web Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=812 Security Bulletin: MS13-067 http://technet.microsoft.com/de-de/security/bulletin/MS13-067 Microsoft Security...

Moderate: Red Hat Security Advisory: xml-security security update

An updated xml-security package that fixes one security issue is now available for Red Hat JBoss Enterprise Application Platform 5.2.0 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update

Red Hat JBoss Enterprise Application Platform 6.1.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.1 update

Red Hat JBoss Enterprise Application Platform 6.1.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scorin...

RHEL 5 / 6 : jbossweb (RHSA-2013:1193)

An updated jbossweb package that fixes one security issue is now available for Red Hat JBoss Enterprise Application Platform 6.1.0 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring...

Important: Red Hat Security Advisory: jbossweb security update

An updated jbossweb package that fixes one security issue is now available for Red Hat JBoss Enterprise Application Platform 6.1.0 for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in IBM TRIRIGA Application Platform 2.x and 3.x before 3.3.1.1, and 8, allow remote authenticated users to inject arbitrary web script or HTML via 1 unspecified input to WebProcess.srv, 2 unspecified input to...

CVE-2013-4003

CVE-2013-4003 affects IBM TRIRIGA Application Platform 2.x and 3.x (before 3.3.1.1) and version 8. It enables multiple cross-site scripting (XSS) vulnerabilities that allow remote authenticated users to inject arbitrary web script or HTML via unspecified input paths: (1) WebProcess.srv, (2) html/...

JBoss Enterprise Application Platform Remote-Naming连接处理验证绕过漏洞

CVE ID:CVE-2013-4218 JBOSS是一个基于J2EE的开放源代码的应用服务器 通过remote-naming把已验证连接缓存在服务器上时存在一个漏洞，在用户成功登录后，远程攻击者可使用remoting客户端需要密码以该用户身份登录，允许以该用户上下文执行任意操作或访问数据 0 JBoss Enterprise Application Platform 6.1.0 厂商解决方案 用户可参考如下厂商提供的安全公告获得补丁信息： http://rhn.redhat.com/errata/RHSA-2013-1151.html...