CVE-2014-8894: Undefined Security Weakness

Open redirect vulnerability in IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and 3.4.1 before 3.4.1.1 allows remote authenticated users to redirect users to arbitrary web sites and conduct phishing attacks via the out parameter...

TWiki 6.0.0 / 6.0.1 WebSearch Cross Site Scripting

This is an advisory for TWiki Administrators: A specially crafted URL parameter to the WebSearch topic may expose a cross-site scripting vulnerability. TWiki http://twiki.org is an Open Source Enterprise Wiki and Web Application Platform used by millions of people. Vulnerable Software Version...

PT-2014-3456

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform EAP versions prior to 6.2.3 Description The issue allows local users to obtain sensitive information by reading the audit.log file due to world-readable permissions. Recommendations For versions...

CVE-2014-0059: Exposure of Sensitive Information to an Unauthorized Actor

JBoss SX and PicketBox, as used in Red Hat JBoss Enterprise Application Platform EAP before 6.2.3, use world-readable permissions on audit.log, which allows local users to obtain sensitive information by reading this file...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.2 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.2 and fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. Red Hat Product Security has rated this update as having Moderate security impact. A Common...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in birtviewer.query in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that...

CVE-2014-4839

CVE-2014-4839 describes a cross-site request forgery (CSRF) in the birtviewer.query component of IBM TRIRIGA Application Platform (versions 3.2, 3.3 up to 3.3.0.2; 3.3.1 up to 3.3.1.3; 3.3.2 up to 3.3.2.2; 3.4 up to 3.4.0.1). The vulnerability allows remote authenticated users to hijack the authe...

PT-2014-6156

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2 through 3.3 before 3.3.0.2 IBM TRIRIGA Application Platform versions 3.3.1 before 3.3.1.3 IBM TRIRIGA Application Platform versions 3.3.2 before 3.3.2.2 IBM TRIRIGA Application Platform versions 3....

CVE-2014-4839: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in birtviewer.query in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to hijack the authentication of arbitrary users for requests that...

CVE-2014-4837

Cross-site scripting XSS vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4836

Cross-site scripting XSS vulnerability in breakOutWithName.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4838

Cross-site scripting XSS vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in GanttProjectSchedulerPopup.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Cross site scripting

Cross-site scripting XSS vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Code injection

IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL...

CVE-2014-4837

Cross-site scripting XSS vulnerability in NewDocument.jsp in IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

CVE-2014-4840

IBM TRIRIGA Application Platform 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1 allows remote attackers to execute arbitrary code via a crafted URL...

CVE-2014-4837

Technical details about CVE-2014-4837 are not publicly provided in the supplied documents. Monitor for updates.

CVE-2014-4838

CVE-2014-4838 describes a cross-site scripting (XSS) vulnerability in the IBM TRIRIGA Application Platform, specifically in GanttProjectSchedulerPopup.jsp. Affected versions include 3.2 and 3.3 before 3.3.0.2, 3.3.1 before 3.3.1.3, 3.3.2 before 3.3.2.2, and 3.4 before 3.4.0.1. The issue allows re...

CVE-2014-4840

The vulnerability CVE-2014-4840 affects IBM TRIRIGA Application Platform versions 3.2 and 3.3 (before 3.3.0.2), 3.3.1 (before 3.3.1.3), 3.3.2 (before 3.3.2.2), and 3.4 (before 3.4.0.1). The issue allows remote attackers to execute arbitrary code via a crafted URL. The provided documents do not sp...