RHEL 5 / 6 : JBoss EAP (RHSA-2014:0204)

Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score,...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.1 security update

Updated Red Hat JBoss Enterprise Application Platform 6.2.1 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Low security impact. A Common Vulnerability Scoring System CVSS base score,...

RHEL 5 : JBoss EAP (RHSA-2014:0170)

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.1 and fix three security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact...

PT-2014-3434

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform JBEAP version 6.2.0 JBoss WildFly Application Server affected versions not specified Description The issue arises when the software is run under a security manager, as it fails to properly restrict...

CVE-2014-0018: Undefined Security Weakness

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.0 and JBoss WildFly Application Server, when run under a security manager, do not properly restrict access to the Modular Service Container MSC service registry, which allows local users to modify the server via a crafted deployment...

CVE-2011-4610

CVE-2011-4610 affects JBoss Web (used in Red Hat JBoss Communications Platform, Enterprise Web Platform, and Enterprise Application Platform) where a crafted UTF-8 surrogate pair at the boundary of an internal buffer can cause a denial of service (infinite loop). Connected advisories note Red Hat...

CVE-2011-4610: Improper Restriction of Operations within the Bounds of a Memory Buffer

JBoss Web, as used in Red Hat JBoss Communications Platform before 5.1.3, Enterprise Web Platform before 5.1.2, Enterprise Application Platform before 5.1.2, and other products, allows remote attackers to cause a denial of service infinite loop via vectors related to a crafted UTF-8 and a...

CVE-2012-3427

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

CVE-2012-3427: Undefined Security Weakness

EC2 Amazon Machine Image AMI in JBoss Enterprise Application Platform EAP 5.1.2 uses 755 permissions for /var/cache/jboss-ec2-eap/, which allows local users to read sensitive information such as Amazon Web Services AWS credentials by reading files in the directory...

PT-2014-2269

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform EAP version 5.1.2 Description The issue allows local users to read sensitive information, including Amazon Web Services AWS credentials, by accessing files in the /var/cache/jboss-ec2-eap/ directory due to...

Adobe ColdFusion Unsupported Version Detection

According to its version, the installation of Adobe ColdFusion running on the remote host is no longer supported. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it is likely to contain security vulnerabilities. %NASLMINLEVEL 70300...

Design/Logic Flaw

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar iss...

CVE-2013-2185

CVE-2013-2185 involves DiskFileItem in Apache Commons FileUpload used with Red Hat JBoss EAP 6.1.0 and JBoss Portal 6.0.0. The issue stems from deserialization of a serialized DiskFileItem where a NULL byte in a filename can let a remote attacker write to arbitrary files. The description notes a ...

CVE-2013-2185: Improper Input Validation

The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar iss...

CVE-2013-2133

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS...

CVE-2013-2133: Undefined Security Weakness

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP before 6.2.0, does not properly enforce the method level restrictions for JAX-WS Service endpoints, which allows remote authenticated users to access otherwise restricted JAX-WS...

PT-2013-1690

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform EAP versions prior to 6.1.0 Red Hat JBoss Portal versions prior to 6.1.0 Description The issue allows local users to control certain applications' authorization decisions via a crafted application...

CVE-2012-4572: Undefined Security Weakness

Red Hat JBoss Enterprise Application Platform EAP before 6.1.0 and JBoss Portal before 6.1.0 does not load the implementation of a custom authorization module for a new application when an implementation is already loaded and the modules share class names, which allows local users to control...

remote-naming: Session fixation due improper connection caching

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

CVE-2013-4210

The org.jboss.remoting.transport.socket.ServerThread class in Red Hat JBoss Remoting for Red Hat JBoss SOA Platform 5.3.1 GA, Web Platform 5.2.0, Enterprise Application Platform 5.2.0, and other products allows remote attackers to cause a denial of service file descriptor consumption via...