CVE-2014-0093: Undefined Security Weakness

Red Hat JBoss Enterprise Application Platform JBEAP 6.2.2, when using a Java Security Manager JSM, does not properly apply permissions defined by a policy file, which causes applications to be granted the java.security.AllPermission permission and allows remote attackers to bypass intended access...

PT-2014-3475

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Enterprise Application Platform JBEAP version 6.2.2 Description The issue is related to the improper application of permissions defined by a policy file when using a Java Security Manager JSM. This causes applications to be grant...

CVE-2011-4573

Red Hat JBoss Operations Network JON before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail...

CVE-2012-0032

Red Hat JBoss Operations Network JON before 3.0.1 uses 0777 permissions for the root directory when installing a remote client, which allows local users to read or modify subdirectories and files within the root directory, as demonstrated by obtaining JON credentials...

Design/Logic Flaw

Red Hat JBoss Operations Network JON before 3.0.1 uses 0777 permissions for the root directory when installing a remote client, which allows local users to read or modify subdirectories and files within the root directory, as demonstrated by obtaining JON credentials...

Design/Logic Flaw

Red Hat JBoss Operations Network JON before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail...

CVE-2012-0032

Red Hat JBoss Operations Network JON before 3.0.1 uses 0777 permissions for the root directory when installing a remote client, which allows local users to read or modify subdirectories and files within the root directory, as demonstrated by obtaining JON credentials...

CVE-2011-4573

Red Hat JBoss Operations Network JON before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail...

CVE-2011-4573

Red Hat JBoss Operations Network (JON) 2.4.1 and earlier versions are affected by CVE-2011-4573. The flaw allows remote authenticated users to bypass modify resource permissions when deleting a plug-in configuration update from the group connection properties history, enabling deletion from the a...

CVE-2012-0032

CVE-2012-0032 affects Red Hat JBoss Operations Network (JON) prior to 3.0.1. The root directory is created with 0777 permissions when installing the remote client, enabling local users to read or modify subdirectories/files and potentially obtain JON credentials. This is a local-privilege-concern...

RHEL 6 : JBoss EAP (RHSA-2014:0344)

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.2 and fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact...

CVE-2012-0032: Undefined Security Weakness

Red Hat JBoss Operations Network JON before 3.0.1 uses 0777 permissions for the root directory when installing a remote client, which allows local users to read or modify subdirectories and files within the root directory, as demonstrated by obtaining JON credentials...

PT-2014-2172

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Operations Network JON versions prior to 2.4.2 Description The issue is related to the improper enforcement of "modify resource" permissions for remote authenticated users. Specifically, when a remote authenticated user deletes a...

PT-2014-2199

Name of the Vulnerable Software and Affected Versions Red Hat JBoss Operations Network JON versions prior to 3.0.1 Description The issue allows local users to read or modify subdirectories and files within the root directory due to the use of 0777 permissions when installing a remote client. This...

RHEL 5 : Red Hat JBoss Enterprise Application Platform 6.2.2 update (Moderate) (RHSA-2014:0343)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0343 advisory. - tomcat: multiple content-length header poisoning flaws CVE-2013-4286 - PicketBox/JBossSX: Unauthorized access to and modification of...

CVE-2011-4573: Undefined Security Weakness

Red Hat JBoss Operations Network JON before 2.4.2 does not properly enforce "modify resource" permissions for remote authenticated users when deleting a plug-in configuration update from the group connection properties history, which prevents such activities from being recorded in the audit trail...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.2 and fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having Moderate security impact...

tomcat: multiple content-length header poisoning flaws

It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote...

Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.2.2 update

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.2.2 and fix two security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact...

tomcat: multiple content-length header poisoning flaws

It was found that when Tomcat / JBoss Web processed a series of HTTP requests in which at least one request contained either multiple content-length headers, or one content-length header with a chunked transfer-encoding header, Tomcat / JBoss Web would incorrectly handle the request. A remote...