Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update

Updated Red Hat JBoss Enterprise Application Platform 6.3.0 packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Important security impact. Common...

Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.3.0 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.3.0 and fix multiple security issues, several bugs, and add various enhancements are now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security...

Moderate: Red Hat Security Advisory: resteasy-base security update

Updated resteasy-base packages that fix one security issue are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

RHEL 7 : resteasy-base (RHSA-2014:1011)

Updated resteasy-base packages that fix one security issue are now available for Red Hat Enterprise Linux 7. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, ...

Important: Red Hat Security Advisory: Red Hat JBoss BRMS 5.3.1 update

Red Hat JBoss BRMS 5.3.1 roll up patch 1 of 2014, which fixes two security issues and various bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores...

CVE-2014-3518

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform JEAP 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to...

CVE-2014-3530

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact vi...

Design/Logic Flaw

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform JEAP 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to...

Xxe

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact vi...

CVE-2014-3518

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform JEAP 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to...

CVE-2014-3518

The CVE-2014-3518 vulnerability affects jmx-remoting.sar in JBoss Remoting, used by Red Hat JBoss EAP 5.2.x and related Red Hat platforms (JEAP 5.2.0, BRMS 5.3.1, Portal Platform 5.2.2, SOA Platform 5.3.1). The root cause is incomplete implementation of the JSR 160 JMX remoting specification, all...

CVE-2014-3518

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform JEAP 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to...

CVE-2014-3530

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact vi...

CVE-2014-3530

CVE-2014-3530 affects Red Hat JBoss EAP/JBoss SOA Platform components using the PicketLink library. The root cause is in org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory(), which expands entity references and enables XML External Entity (XXE) processing. This can allow a remote a...

PT-2014-5369

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform version 5.2.0 Red Hat JBoss BRMS version 5.3.1 Red Hat JBoss Portal Platform version 5.2.2 Red Hat JBoss SOA Platform version 5.3.1 Description The issue is related to the improper implementation o...

CVE-2014-3530: Exposure of Sensitive Information to an Unauthorized Actor

The org.picketlink.common.util.DocumentUtil.getDocumentBuilderFactory method in PicketLink, as used in Red Hat JBoss Enterprise Application Platform JBEAP 5.2.0 and 6.2.4, expands entity references, which allows remote attackers to read arbitrary code and possibly have other unspecified impact vi...

CVE-2014-3518: Improper Control of Generation of Code

jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss Enterprise Application Platform JEAP 5.2.0, Red Hat JBoss BRMS 5.3.1, Red Hat JBoss Portal Platform 5.2.2, and Red Hat JBoss SOA Platform 5.3.1, does not properly implement the JSR 160 specification, which allows remote attackers to...

Important: Red Hat Security Advisory: Red Hat JBoss Operations Network 3.2.2 update

Red Hat JBoss Operations Network 3.2.2, which fixes multiple security issues and several bugs, is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, whi...

JBoss JMX Console Beanshell Deployer WAR Upload and Deployment

This module can be used to install a WAR file payload on JBoss servers that have an exposed "jmx-console" application. The payload is put on the server by using the jboss.system:BSHDeployer's createScriptDeployment method. This module requires Metasploit: https://metasploit.com/download Current...

RHEL 6 : Red Hat JBoss Enterprise Web Platform 5.2.0 (RHSA-2014:0898)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2014:0898 advisory. Red Hat JBoss Enterprise Web Platform is a platform for Java applications, which integrates the JBoss Web Server with JBoss Hibernate and JBoss Seam...