97 matches found
CVE-2017-7556
Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...
Cross site request forgery (csrf)
Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...
CVE-2017-7556
Hawtio versions up to and including 1.5.3 are vulnerable to CSRF vulnerability allowing remote attackers to trick the user to visit their website containing a malicious script which can be submitted to hawtio server on behalf of the user...
CVE-2017-7556
CVE-2017-7556 affects hawtio up to version 1.5.3, where a cross-site request forgery (CSRF) vulnerability exists. The issue allows a remote attacker to lure an authenticated user to a malicious site hosting a script that can be submitted to the hawtio server on behalf of that user. The provided c...
hawtio: Proxy is sharing cookies among all the clients
It was discovered that the hawtio servlet uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...
Important: Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update
An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...
hawtio: information Disclosure flaws due to unsafe path traversal
It was found that a path traversal vulnerability in hawtio leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root...
CVE-2017-7556
It was found that hawtio contains a CSRF flaw that allows unrelated websites to perform actions as the authenticated user. Attackers could use this vulnerability to trick the user to visit his website that contains a malicious script which can be submitted to hawtio server on behalf of the user...
CVE-2017-2589
It was discovered that the hawtio servlet uses a single HttpClient instance to proxy requests with a persistent cookie store cookies are stored locally and are not passed between the client and the end URL which means all clients using that proxy are sharing the same cookies...
Hawtio Directory Traversal Vulnerability
hawtio is a Web console for managing Java frameworks . A directory traversal vulnerability exists in hawtio due to the program failing to properly filter user-submitted input. A remote attacker can exploit this vulnerability by using directory traversal characters '... /' to access arbitrary file...
Hawtio Arbitrary File Upload Vulnerability
Hawtio is a web management console for managing JAVA. An arbitrary file upload vulnerability exists in Hawtio. An attacker could use this vulnerability to upload arbitrary files to an affected computer, resulting in arbitrary code execution...
CVE-2017-2617
It was found that a flaw in hawtio could cause remote code execution via file upload. An attacker could use this vulnerability to upload crafted file which could be executed on a target machine where hawtio is deployed...
CVE-2017-2594
It was found that a path traversal vulnerability in hawtio leads to a NullPointerException with a full stacktrace. An attacker could use this flaw to gather undisclosed information from within hawtio's root...
Console: CORS headers set to allow all in Red Hat AMQ
It was found that the Hawtio console setting for the Access-Control-Allow-Origin header permits unrestricted sharing allow all. An attacker could use this flaw to access sensitive information or perform other attacks...
Design/Logic Flaw
Red Hat JBoss Fuse before 6.2.0 allows remote authenticated users to bypass intended restrictions and access the HawtIO console by leveraging an account defined in the users.properties file...