CVE-2014-8893: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in 1 mainpage.jsp and 2 GetImageServlet.img in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allow remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-8895: Undefined Security Weakness

IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL...

TWiki 6.0.0 / 6.0.1 WebSearch Cross Site Scripting

This is an advisory for TWiki Administrators: A specially crafted URL parameter to the WebSearch topic may expose a cross-site scripting vulnerability. TWiki http://twiki.org is an Open Source Enterprise Wiki and Web Application Platform used by millions of people. Vulnerable Software Version...

CVE-2014-0059: Exposure of Sensitive Information to an Unauthorized Actor

JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform EAP before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.2 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. A Common...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in birtviewer.query in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that...

CVE-2014-4839

CVE-2014-4839 describes a cross-site request forgery (CSRF) in the birtviewer.query component of IBM TRIRIGA Application Platform (versions 3.2, 3.3 up to 3.3.0.2; 3.3.1 up to 3.3.1.3; 3.3.2 up to 3.3.2.2; 3.4 up to 3.4.0.1). The vulnerability allows remote authenticated users to hijack the authe...

CVE-2014-4839: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in birtviewer.query in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that...

CVE-2014-4836

Cross-site scripting XSS vulnerability in breakOutWithName.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4837

Cross-site scripting XSS vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4838

Cross-site scripting XSS vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Code injection

IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4837

Cross-site scripting XSS vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4837

Technical details about CVE-2014-4837 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2014-4840

IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL...

CVE-2014-4840

The vulnerability CVE-2014-4840 affects IBM TRIRIGA Application Platform versions 3.2 and 3.3 (before 3.3.0.2), 3.3.1 (before 3.3.1.3), 3.3.2 (before 3.3.2.2), and 3.4 (before 3.4.0.1). The issue allows remote attackers to execute arbitrary code via a crafted URL. The provided documents do not sp...

CVE-2014-4836

Cross-site scripting XSS vulnerability in breakOutWithName.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4838

CVE-2014-4838 describes a cross-site scripting (XSS) vulnerability in the IBM TRIRIGA Application Platform, specifically in GanttProjectSchedulerPopup.jsp. Affected versions include 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1. The issue allows re...