CVE-2013-4128

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by remote-naming, which allows remote attackers to hijack sessions by using a remoting client...

CVE-2013-4213

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

RHEL 5 / 6 : JBoss EAP (RHSA-2013:1151)

Updated Red Hat JBoss Enterprise Application Platform 6.1.0 packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.0 security update

An update for Red Hat JBoss Enterprise Application Platform 6.1.0 that fixes two security issues is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores,...

ejb-client: Session fixation due improper connection caching

Red Hat JBoss Enterprise Application Platform EAP 6.1.0 does not properly cache EJB invocations by the EJB client API, which allows remote attackers to hijack sessions by using an EJB client...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.1.0 security update

Updated Red Hat JBoss Enterprise Application Platform 6.1.0 packages that fix two security issues are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base...

Sybase EAServer 6.3.1 - Multiple Vulnerabilities

Sybase EAServer fully supports all the Web services standards and enables enterprises to rapidly expose business functions as Web services. EAServer also provides a graphical interface to automate the publication and management of your company’s Web services. Today, EAServer supports EJB and...

CVE-2012-4550

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

CVE-2012-4549

A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans EJB method invocation. This allows attacker...

CVE-2012-4549

A flaw was found in JBoss Enterprise Application Platform. The processInvocation function within the org.jboss.as.ejb3.security.AuthorizationInterceptor component incorrectly authorizes all requests when no roles are defined for an Enterprise Java Beans EJB method invocation. This allows attacker...

CVE-2012-4550

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

Authorization

JBoss Enterprise Application Platform aka JBoss EAP or JBEAP before 6.0.1, when using role-based authorization for Enterprise Java Beans EJB access, does not call the intended authorization modules, which prevents JACC permissions from being applied and allows remote attackers to obtain access to...

CVE-2012-4550

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

JBoss Enterprise Application Platform安全绕过漏洞

CVE ID:CVE-2012-4550 JBOSS是一个基于J2EE的开放源代码的应用服务器。 当使用基于角色的授权用于Enterprise Java Beans EJB访问时，必须使用JACC权限来判断访问；但是存在一个安全漏洞没有调用配置的授权模块JACC, XACML等，使得JACC权限没有用来判断EJB访问，允许远程攻击者获得对EJB的未授权访问。 0 JBoss Enterprise Application Platform 即JBoss EAP或JBEAP 6.0.1之前版本 厂商解决方案 JBoss Enterprise Application Platform...

CVE-2012-4550 Jboss enterprise application platform: jboss eap: jbeap: jboss enterprise application platform: unauthorized ejb access via authorization module bypass

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

PT-2013-1686

Name of the Vulnerable Software and Affected Versions JBoss Enterprise Application Platform versions prior to 6.0.1 Description The issue prevents the application of JACC permissions for Enterprise Java Beans EJB access when using role-based authorization, allowing remote attackers to obtain...

JBoss Enterprise Application Platform 安全绕过漏洞(CVE-2012-4549)

Bugtraq ID:56990 CVE ID:CVE-2012-4549 JBOSS是一个基于J2EE的开放源代码的应用服务器。 在不允许任何角色调用EJB方法时，需要拒绝所有用户的调用。当允许角色列表为空时，org.jboss.as.ejb3.security.AuthorizationInterceptor中的processInvocation方法不正确授权方法调用，允许攻击者绕过安全限制执行未授权操作。 0 JBoss Enterprise Application Platform 6 厂商解决方案 JBoss Enterprise Application Platform...

JBoss Enterprise Application Platform: JBoss EAP: JBEAP: JBoss Enterprise Application Platform: Unauthorized EJB access via authorization module bypass

A flaw was found in JBoss Enterprise Application Platform. When role-based authorization is used for Enterprise Java Beans EJB access, the system does not correctly call the necessary authorization modules. This prevents Java Authorization Contract for Containers JACC permissions from being...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update

JBoss Enterprise Application Platform 6.0.1, which fixes multiple security issues, various bugs, and adds enhancements, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring...

Important: Red Hat Security Advisory: JBoss Enterprise Application Platform 6.0.1 update

Updated JBoss Enterprise Application Platform 6.0.1 packages that fix multiple security issues, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability...