PT-2018-13437

Name of the Vulnerable Software and Affected Versions IBM WebSphere Application Server versions 7.0 through 9.0 Description The issue is caused by improper handling of some datasource custom properties, which could allow a local attacker to obtain clear text passwords in a trace file...

CVE-2018-1621: Cleartext Storage of Sensitive Information

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local attacker to obtain clear text password in a trace file caused by improper handling of some datasource custom properties. IBM X-Force ID: 144346...

CVE-2013-3734: Undefined Security Weakness

The Embedded Jopr component in JBoss Application Server includes the cleartext datasource password in unspecified HTML responses, which might allow 1 man-in-the-middle attackers to obtain sensitive information by leveraging failure to use SSL or 2 attackers to obtain sensitive information by...

PT-2017-13669

Name of the Vulnerable Software and Affected Versions OpenText Document Sciences xPression versions prior to v4.5SP1 Patch 13 Description The issue allows for Arbitrary File Read. An attacker must first authenticate to the application. The "/xAdmin/html/cm datasource group xsd.jsp" API endpoint i...

CVE-2017-7694

Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor...

CVE-2017-7694: Improper Control of Generation of Code

Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor...

PT-2017-17892

Name of the Vulnerable Software and Affected Versions Symphony CMS versions prior to 2.6.12 Description A Remote Code Execution issue allows remote attackers to execute code and obtain a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or...

Mozilla: Vulnerabilities found through code inspection (MFSA 2015-66)

The YCbCrImageDataDeserializer::ToDataSourceSurface function in the YCbCr implementation in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and Thunderbird before 38.1 reads data from uninitialized memory locations, which has unspecified impact and attack vectors...

SAP Crystal Reports Datasource Stack Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP Crystal Reports. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling...

Microsoft Internet Explorer 4/5/6 XML Datasource Applet File Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/5490/info A problem in Microsoft Internet Explorer could lead to the disclosure of sensitive information. Due to the design of the datasource applet, it may be possible for a user to view the contents of local files via a...

PT-2014-3530 · Red Hat · Rhevm-Reports

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager reports rhevm-reports versions prior to 3.3.3-1 Description: The issue allows local users to obtain sensitive information by reading a configuration file due to world-readable permissions. The file in...

ovirt-engine-reports: js-jboss7-ds.xml is world-readable

The Red Hat Enterprise Virtualization Manager reports rhevm-reports package before 3.3.3-1 uses world-readable permissions on the datasource configuration file js-jboss7-ds.xml, which allows local users to obtain sensitive information by reading the file...

CVE-2012-3428

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

Design/Logic Flaw

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

CVE-2012-3428

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

PT-2012-4703

Name of the Vulnerable Software and Affected Versions IronJacamar container versions prior to 1.0.12.Final for JBoss Application Server Description The issue allows remote attackers to obtain access to an arbitrary datasource connection under certain circumstances, specifically when...

CVE-2012-3428: Undefined Security Weakness

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...

JBoss: Datasource connection manager returns valid connection for wrong credentials when using security-domains

The IronJacamar container before 1.0.12.Final for JBoss Application Server, when allow-multiple-users is enabled in conjunction with a security domain, does not use the credentials supplied in a getConnection function call, which allows remote attackers to obtain access to an arbitrary datasource...