Moderate: Red Hat Security Advisory: Red Hat AMQ Broker 7.4.5 release and security update

Red Hat AMQ Broker 7.4.5 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Console: HTTPOnly and Secure attributes not set on cookies in Red Hat AMQ

It was found that Hawtio console does not set HTTPOnly or Secure attributes on cookies. An attacker could use this flaw to rerieve an authenticated user's SessionID, and possibly conduct further attacks with the permissions of the authenticated user...

@0negativ/hawtio-integration (>=4.13.7-rc4 <=4.13.7-rc5), @archey347/uf_blog (=0.0.0) +383 more potentially affected by CVE-2019-20921 via bootstrap-select (>=1.10.0 <=1.13.5)

bootstrap-select NPM version =1.10.0, =4.13.7-rc4, =1.31.0, =1.13.0, =1.0.9, =2.0.0, =0.1.0, =1.0.0, =2.0.0, =2.2.0, =0.0.4, =2.0.0, =2.0.31 and more Source cves: CVE-2019-20921 Source advisory: OSV:GHSA-9R7H-6639-V5MW...

hawtio: server side request forgery via initial /proxy/ substring of a URI

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI...

hawtio: server side request forgery via initial /proxy/ substring of a URI

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI...

Important: Red Hat Security Advisory: Red Hat Fuse 7.7.0 release and security update

A minor version update from 7.6 to 7.7 is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring...

CVE-2019-9827

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI...

Insecure Cookie Management

hawtio uses insecure cookie management. The vulnerability exists because a persistent cookie store that stores cookies locally results in all clients of the proxy to share the same cookies which allows an attacker to access the cookie information...

com.github.igor-suhorukov:git-configuration (=1.0), com.mageddo:spring-hawtio (>=2.0.2 <=2.3.0_1.2.0) +72 more potentially affected by CVE-2019-9827 via io.hawt:hawtio-core (>=1.1 <=2.4.0)

io.hawt:hawtio-core MAVEN version =1.1, =2.0.2, =2.0.21, =2.0.0, =2.0.1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.1, =2.0.0, =1.1.0.Beta1, =1.1.0.Beta1, =1.1.0.Beta1, =2.0-M3, =2.17.7 and more Source cves: CVE-2019-9827 Source advisory: OSV:GHSA-MCG9-64CP-XWP7...

Server-Side Request Forgery in Hawt Hawtio

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI...

GHSA-MCG9-64CP-XWP7 Server-Side Request Forgery in Hawt Hawtio

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI...

Server-Side Request Forgery (SSRF)

hawtio-system is vulnerable to server-side request forgery SSRF. A proxy whitelist that is configured to prevent accessing arbitrary URLs was configured but the vulnerability still exists as it is possible to submit HTTP requests to local addresses through the /proxy/ servlet page. This allows a...

CVE-2019-9827

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI...

CVE-2019-9827

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI...

Server side request forgery (ssrf)

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI...

CVE-2019-9827

Hawt Hawtio through 2.5.0 is vulnerable to SSRF, allowing a remote attacker to trigger an HTTP request from an affected server to an arbitrary host via the initial /proxy/ substring of a URI...

CVE-2019-9827

CVE-2019-9827 affects Hawtio up to version 2.5.0, enabling SSRF by triggering an HTTP request from the server to a target via the URI’s initial /proxy/ substring. Public references confirm the issue in Hawtio/Hawtio-related components; Red Hat advisories list hawtio SSRF as a fixed issue in AMQ B...

Hawtio 2.5.0 Server Side Request Forgery

CipherTechs Inc - Security Advisory Hawtio Server-Side Request Forgery Introduction ============ Hawtio https://hawt.io/ is a modular web console for managing Java. CipherTechs discovered that Hawtio up to and including version 2.5.0 is vulnerable to unauthenticated Server-Side Request Forgery...

Hawtio 2.5.0 Server Side Request Forgery Vulnerability

Exploit for java platform in category web applications Hawtio Server-Side Request Forgery Introduction ============ Hawtio https://hawt.io/ is a modular web console for managing Java. CipherTechs discovered that Hawtio up to and including version 2.5.0 is vulnerable to unauthenticated Server-Side...

Information Disclosure

hawtio-system is vulnerable to an information disclosure. The library displays the entire stack trace when it runs into an exception in accessing a non-existent directory, allowing a malicious user to gather sensitive information from it...