Information Disclosure

JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a replacement for JBoss Enterprise Application Platform 6.0.0, and includes bug fixes and enhancements. Refer to the 6.0.1 Release Notes for information on the...

Authorization Bypass

JBoss Application Server is the base package for JBoss Enterprise Application Platform, providing the core server components. The Java Naming and Directory Interface JNDI Java API allows Java software clients to locate objects or services in an application server. The Java Authorization Contract...

jackson-databind: improper polymorphic deserialization in jboss-common-core class

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the jboss-common-core class. An attacker could use this flaw to execute arbitrary code...

Important: Red Hat Bug Fix Advisory: Red Hat Virtualization Manager (ovirt-engine) 4.2.8

An update is now available for Red Hat Virtualization Manager. The Red Hat Virtualization Manager is a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities,...

jackson-databind: improper polymorphic deserialization in jboss-common-core class

A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the jboss-common-core class. An attacker could use this flaw to execute arbitrary code...

CVE-2018-10934

A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...

Cross site scripting

A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...

CVE-2018-10934

A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...

CVE-2018-10934

A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...

CVE-2018-10934

CVE-2018-10934 is an XSS in the JBoss Management Console that affects JBoss EAP/JBoss AS versions prior to 7.1.6.CR1 and 7.1.6.GA, enabling attackers with object-creation privileges to target other privileged users. The linked Red Hat advisories indicate remediation via upgrading to 7.1.6.x (CR1/...

PT-2019-8771

Name of the Vulnerable Software and Affected Versions JBoss Management Console versions prior to 7.1.6.CR1 JBoss Management Console versions prior to 7.1.6.GA Description A cross-site scripting XSS issue was discovered. This allows users with object creation capabilities to attack other privilege...

CVE-2018-10934: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA. Users with roles that can create objects in the application can exploit this to attack other privileged users...

CVE-2014-5401

Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet software, MedNet 6.1. Existing versio...

Input validation

Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet software, MedNet 6.1. Existing versio...

CVE-2014-5401

The CVE-2014-5401 issue affects Hospira MedNet software versions 5.8 and earlier, which bundle vulnerable JBoss Enterprise Application Platform components. The root cause is improper handling of the affected JBoss code, enabling unauthenticated remote code execution on MedNet servers. Hospira has...

CVE-2014-5401 Hospira MedNet Code Injection

Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet software, MedNet 6.1. Existing versio...

CVE-2014-5401: Improper Control of Generation of Code

Hospira MedNet software version 5.8 and prior uses vulnerable versions of the JBoss Enterprise Application Platform software that may allow unauthenticated users to execute arbitrary code on the target system. Hospira has developed a new version of the MedNet software, MedNet 6.1. Existing versio...

PT-2019-7126

Name of the Vulnerable Software and Affected Versions Hospira MedNet software versions 5.8 and prior Description The issue allows unauthenticated users to execute arbitrary code on the target system due to the use of vulnerable versions of the JBoss Enterprise Application Platform software...

Cross-Site Scripting (XSS)

Red Hat JBoss Operations Network is vulnerable to cross-site scripting XSS. Lack of input validation in the Administration Interface allows remote attackers to inject arbitrary Javascript into a victim's browser to steal session tokens or perform unwanted actions on behalf of the user...

RHEL 6 / 7 : Red Hat JBoss Web Server 5.0 Service Pack 2 (RHSA-2019:0451)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:0451 advisory. Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the...