CVE-2016-5422

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

Design/Logic Flaw

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

CVE-2016-5422

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

CVE-2016-5422

The CVE-2016-5422 issue affects Red Hat JBoss Operations Network (JON) prior to 3.3.7. The web console fails to properly authorize requests to add users with the super user role, enabling remote authenticated users to elevate privileges to admin via a crafted POST. The widely cited Red Hat adviso...

CVE-2016-7034

The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to 1 bypass CSRF protection mechanisms or 2 conduct cross-site request forgery CSRF attacks by...

CVE-2016-7034

The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to 1 bypass CSRF protection mechanisms or 2 conduct cross-site request forgery CSRF attacks by...

CVE-2016-7033

Multiple cross-site scripting XSS vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-6344

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

Design/Logic Flaw

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

CVE-2016-6344

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

CVE-2016-6344

CVE-2016-6344 affects Red Hat JBoss BRMS 6 and Red Hat JBoss BPM Suite 6, where HttpOnly flags are not set on session cookies. This exposes cookies to access via client-side scripts (XSS), enabling potential information disclosure. Red Hat RHSA-2017:0248/0249 documents a security update for BRMS/...

CVE-2016-6344

Red Hat JBoss BPM Suite 6.3.x does not include the HTTPOnly flag in a Set-Cookie header for session cookies, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies...

CVE-2016-7033

Multiple cross-site scripting XSS vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2016-7034

The dashbuilder in Red Hat JBoss BPM Suite 6.3.2 does not properly handle CSRF tokens generated during an active session and includes them in query strings, which makes easier for remote attackers to 1 bypass CSRF protection mechanisms or 2 conduct cross-site request forgery CSRF attacks by...

CVE-2016-7033

CVE-2016-7033 is a stored XSS flaw in dashbuilder within Red Hat JBoss BPM Suite and JBoss BRMS 6.x. The Red Hat advisory RHSA-2017:0249 states the issue is caused by improper sanitization in dashbuilder, enabling remote, authenticated attackers with dashbuilder access (usually admins) to store s...

CVE-2016-7034

CVE-2016-7034 concerns the dashbuilder component of Red Hat JBoss BPM Suite 6.x, where CSRF tokens generated during an active session are included in query strings. The underlying issue allows bypassing CSRF protections or performing CSRF attacks using old tokens. Red Hat advisories RHSA-2017:055...

Red Hat JBoss BPMS Cross-Site Request Forgery Vulnerability

Red Hat JBoss BPMS is a business process management platform from Red Hat that combines all the features of JBoss BRMS. The platform provides additional support for modeling, automation, simulation, and business process monitoring. A cross-site request forgery vulnerability exists in Red Hat JBos...

CVE-2016-5422: Undefined Security Weakness

The web console in Red Hat JBoss Operations Network JON before 3.3.7 does not properly authorize requests to add users with the super user role, which allows remote authenticated users to gain admin privileges via a crafted POST request...

PT-2016-7187

Name of the Vulnerable Software and Affected Versions Red Hat JBoss BPM Suite version 6.3.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the admin pages of dashbuilder. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via...

CVE-2016-7033: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the admin pages in dashbuilder in Red Hat JBoss BPM Suite 6.3.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...