CVE-2014-3472

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

CVE-2014-3490

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...

CVE-2014-3472

The CVE-2014-3472 issue affects JBoss AS 7 as used in JBoss EAP/JBEAP (specifically 6.3.0). The root cause is an improper caller role check in SimpleSecurityManager.isCallerInRole, allowing remote authenticated users to bypass access restrictions via unspecified vectors. Documents consistently de...

CVE-2014-3490

CVE-2014-3490 affects RESTEasy used in Red Hat JBoss EAP 6.3.0 via RESTEasy 2.3.1–2.3.7 and 3.x before 3.0.9 when the parameter resteasy.document.expand.entity.references is not disabled. An XXE condition could allow remote attackers to read arbitrary local files and potentially other unspecified...

CVE-2014-3490

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...

CVE-2014-3464

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers...

CVE-2014-3472

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

CVE-2014-3464

CVE-2014-3464 affects Red Hat JBossWS used in JBoss EAP 6.2.0 and 6.3.0. The EJB invocation handler fails to enforce method-level restrictions for outbound messages, allowing remote authenticated users to access restricted JAX-WS handlers via permissions to the EJB class. This stems from an incom...

CVE-2014-3472: Undefined Security Weakness

The isCallerInRole function in SimpleSecurityManager in JBoss Application Server AS 7, as used in Red Hat JBoss Enterprise Application Platform JBEAP 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors...

CVE-2014-3490: Undefined Security Weakness

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform EAP 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and hav...

CVE-2014-3464: Undefined Security Weakness

The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform EAP 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers...

PT-2014-5344

Name of the Vulnerable Software and Affected Versions JBoss Application Server versions 7 Red Hat JBoss Enterprise Application Platform version 6.3.0 Description The issue is related to the isCallerInRole function in SimpleSecurityManager, which does not properly check caller roles. This allows...

Important: Red Hat Security Advisory: JBoss Enterprise Portal Platform 5.2.2 security update

An update for the GateIn Portal component in JBoss Enterprise Portal Platform 5.2.2 that fixes two security issues is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base...

RHEL 5 / 6 / 7 : JBoss EAP (RHSA-2014:1040)

Updated Red Hat JBoss Enterprise Application Platform 6.3.0 packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score,...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update

Updated Red Hat JBoss Enterprise Application Platform 6.3.0 packages that fix one security issue are now available for Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score,...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 security update

An update for Red Hat JBoss Enterprise Application Platform 6.3.0 that fixes one security issue is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives ...

RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.3.0 update (Important) (RHSA-2014:1019)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1019 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A race condition...

RHEL 6 : Red Hat JBoss Enterprise Application Platform 6.3.0 update (Important) (RHSA-2014:1020)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:1020 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. A race condition...

Tomcat/JBossWeb: XML parser hijack by malicious web application

It was found that, in certain circumstances, it was possible for a malicious web application to replace the XML parsers used by JBoss Web / Apache Tomcat to process XSLTs for the default servlet, JSP documents, tag library descriptors TLDs, and tag plug-in configuration files. The injected XML...

CentOS 7 : resteasy-base (CESA-2014:1011)

Updated resteasy-base packages that fix one security issue are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...