Moderate: Red Hat Security Advisory: Red Hat JBoss Web Server 2.1.0 tomcat security update

Updated tomcat6 and tomcat7 packages that fix two security issues are now available for Red Hat JBoss Web Server 2.1.0 on Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System CVSS base scores,...

CVE-2015-5176

The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource...

CVE-2015-3267

Cross-site scripting XSS vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Server side request forgery (ssrf)

XML external entity XXE vulnerability in the dashbuilder import facility DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery SSRF attacks, and have other...

Cross site scripting

Cross-site scripting XSS vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

Design/Logic Flaw

The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource...

CVE-2015-1818

XML external entity XXE vulnerability in the dashbuilder import facility DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery SSRF attacks, and have other...

CVE-2015-5176

The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource...

CVE-2015-1818

XML external entity XXE vulnerability in the dashbuilder import facility DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery SSRF attacks, and have other...

CVE-2015-1818

CVE-2015-1818 affects Red Hat JBoss BPM Suite's dashbuilder import facility (DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl) where XML External Entity (XXE) processing was not disabled, enabling read of arbitrary files and SSRF via crafted XML. Impact is partial confidentiality/...

CVE-2015-3267

Cross-site scripting XSS vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-3267

The CVE-2015-3267 entry concerns an XSS vulnerability in the 404 error page of Red Hat JBoss Operations Network prior to version 3.3.3. The underlying issue is insufficient input validation on the error page, enabling remote attackers to inject arbitrary script or HTML via a crafted URL. The vuln...

CVE-2015-5176

CVE-2015-5176 concerns Red Hat JBoss Portal 6.2.0: the PortletBridge PortletRequestDispatcher fails to enforce servlet security constraints, allowing a remote attacker to access resources by requesting rendering of a non-JSF resource. Root cause: improper enforcement of servlet constraints in Por...

PT-2015-6127

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Operations Network versions prior to 3.3.3 Description A cross-site scripting XSS issue exists in the 404 error page, allowing remote attackers to inject arbitrary web script or HTML via a crafted URL. This could potentially lead...

PT-2015-5457

Name of the Vulnerable Software and Affected Versions Red Hat JBoss BPM Suite versions prior to 6.1.2 Description The issue is related to an XML external entity XXE vulnerability in the dashbuilder import facility. This vulnerability allows remote attackers to read arbitrary files, conduct...

CVE-2015-3267: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the 404 error page in Red Hat JBoss Operations Network before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted URL...

CVE-2015-1818: Undefined Security Weakness

XML external entity XXE vulnerability in the dashbuilder import facility DocumentBuilders in org.jboss.dashboard.export.ImportManagerImpl in Red Hat JBoss BPM Suite before 6.1.2 allows remote attackers to read arbitrary files, conduct server-side request forgery SSRF attacks, and have other...

CVE-2015-5176: Undefined Security Weakness

The PortletRequestDispatcher in PortletBridge, as used in Red Hat JBoss Portal 6.2.0, does not properly enforce the security constraints of servlets, which allows remote attackers to gain access to resources via a request that asks to render a non-JSF resource...

PT-2015-6791

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Portal version 6.2.0 Description The issue is related to the PortletRequestDispatcher in PortletBridge, which does not properly enforce the security constraints of servlets. This allows remote attackers to gain access to resource...

Red Hat JBoss Operations Network HTTP Error Page Cross-Site Scripting Vulnerability

JBoss Operations Network is open source network management software based on Java EE. An input validation vulnerability in the JBoss Operations Network HTTP error page allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensiti...