Xxe

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact vi...

CVE-2014-3530: Exposure of Sensitive Information to an Unauthorized Actor

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact vi...

CVE-2014-3518: Improper Control of Generation of Code

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform JEAP 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2.0 security update

Updated packages for Red Hat JBoss Enterprise Application Platform 5.2.0 that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS...

RHEL 5 / 6 : Red Hat JBoss Enterprise Application Platform 6.2.4 (RHSA-2014:0843)

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2014:0843 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. It was discover...

CVE-2014-3481

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform JEAP before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity XXE issue...

CVE-2014-3481: Exposure of Sensitive Information to an Unauthorized Actor

org.jboss.as.jaxrs.deployment.JaxrsIntegrationProcessor in Red Hat JBoss Enterprise Application Platform JEAP before 6.2.4 enables entity expansion, which allows remote attackers to read arbitrary files via unspecified vectors, related to an XML External Entity XXE issue...

CVE-2014-0248: Improper Control of Generation of Code

org.jboss.seam.web.AuthenticationFilter in Red Hat JBoss Web Framework Kit 2.5.0, JBoss Enterprise Application Platform JBEAP 5.2.0, and JBoss Enterprise Web Platform JBEWP 5.2.0 allows remote attackers to execute arbitrary code via a crafted authentication header, related to Seam logging...

RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.2.4 update (Moderate) (RHSA-2014:0798)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0798 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. Apache CXF is an op...

RHEL 5 / 6 : Red Hat JBoss Enterprise Application Platform 5.2.0 (RHSA-2014:0793)

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0793 advisory. Red Hat JBoss Enterprise Application Platform is a platform for Java applications, which integrates the JBoss Application Server with JBoss...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.4 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.4 and fix multiple security issues, several bugs, and add various enhancements are now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Moderate security...

Low: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.3 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.3 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Low security impact. A Comm...

CVE-2013-6726

Multiple cross-site scripting XSS vulnerabilities in WebProcess.srv in IBM TRIRIGA Application Platform 3.2.x and 3.3.x before 3.3.1.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6726

CVE-2013-6726 concerns multiple cross-site scripting (XSS) vulnerabilities in IBM TRIRIGA Application Platform, specifically within WebProcess.srv. Affected versions are 3.2.x and 3.3.x prior to 3.3.1.2. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspec...

CVE-2013-6726

Multiple cross-site scripting XSS vulnerabilities in WebProcess.srv in IBM TRIRIGA Application Platform 3.2.x and 3.3.x before 3.3.1.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-6726: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in WebProcess.srv in IBM TRIRIGA Application Platform 3.2.x and 3.3.x before 3.3.1.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors...

Adobe Adds Security Upgrades to ColdFusion 11

Suffice it to say, the security of Adobe’s ColdFusion web application platform hasn’t had the best 18-month stretch. Hackers have had their way with vulnerabilities in the software, which have been used in a number of high-profile data breaches, including some suspect, one involving Adobe itself...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 security update

Updated Red Hat JBoss Enterprise Application Platform 6.2.2 packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base...

CVE-2014-0093

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.2, when using a Java Security Manager JSM, does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access...

Design/Logic Flaw

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.2, when using a Java Security Manager JSM, does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access...