JBoss: SecurityAssociation.getCredential() will return the previous credential if no security context is provided

The SecurityAssociation.getCredential method in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 returns the credentials of the previous user when a security context is not provided, which allows remot...

JBoss invoker servlets do not require authentication

The 1 JMXInvokerHAServlet and 2 EJBInvokerHAServlet invoker servlets in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 do not require authentication by default in certain profiles, which might allow...

jbossws: Prone to character encoding pattern attack (XML Encryption flaw)

The W3C XML Encryption Standard, as used in the JBoss Web Services JBossWS component in JBoss Enterprise Portal Platform before 5.2.2 and other products, when using block ciphers in cipher-block chaining CBC mode, allows remote attackers to obtain plaintext data via a chosen-ciphertext attack on...

CSRF on jmx-console allows invocation of operations on mbeans

Cross-site request forgery CSRF vulnerability in the JMX Console jmx-console in JBoss Enterprise Portal Platform before 5.2.2, BRMS Platform 5.3.0 before roll up patch1, and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that...

JBoss: twiddle.sh accepts credentials as command line arguments, exposing them to other local users via a process listing

twiddle.sh in JBoss AS 5.0 and EAP 5.0 and earlier accepts credentials as command-line arguments, which allows local users to read the credentials by listing the process and its arguments...

JBoss: CallerIdentityLoginModule retaining password from previous call if a null password is provided

The CallerIdentityLoginModule in JBoss Enterprise Application Platform EAP before 5.2.0, Web Platform EWP before 5.2.0, BRMS Platform before 5.3.1, and SOA Platform before 5.3.1 allows remote attackers to gain privileges of the previous user via a null password, which causes the previous user's...

RHEL 6 : JBoss Enterprise Application Platform 5.1.1 update (Important) (RHSA-2011:0946)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0946 advisory. JBoss Enterprise Application Platform is the market-leading platform for innovative and scalable Java applications. JBoss Enterprise Application...

RHEL 4 : JBoss EAP (RHSA-2009:1144)

Updated JBoss Enterprise Application Platform JBEAP 4.2 packages that fix various issues are now available for Red Hat Enterprise Linux 4 as JBEAP 4.2.0.CP07. This update has been rated as having important security impact by the Red Hat Security Response Team. JBoss Enterprise Application Platfor...

RHEL 4 : JBoss EAP (RHSA-2009:0347)

Updated JBoss Enterprise Application Platform JBoss EAP 4.3 packages that fix various issues are now available for Red Hat Enterprise Linux 4 as JBEAP 4.3.0.CP04. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

RHEL 5 : JBoss Enterprise Application Platform 4.3.0.CP09 update (Important) (RHSA-2010:0938)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2010:0938 advisory. JBoss Enterprise Application Platform is the market leading platform for innovative and scalable Java applications; integrating the JBoss...

RHEL 5 : JBoss EAP (RHSA-2010:0960)

Updated JBoss Enterprise Application Platform 5.1 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score,...

RHEL 4 / 5 : jbossws-common (RHSA-2011:1306)

An updated jbossws-common package that fixes one security issue is now available for JBoss Enterprise Application Platform 4.3 for Red Hat Enterprise Linux 4 and 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

RHEL 5 : JBoss EAP (RHSA-2009:1143)

Updated JBoss Enterprise Application Platform JBEAP 4.2 packages that fix various issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.2.0.CP07. This update has been rated as having important security impact by the Red Hat Security Response Team. JBoss Enterprise Application Platfor...

RHEL 5 : JBoss EAP (RHSA-2013:0192)

Updated JBoss Enterprise Application Platform 5.2.0 packages that fix multiple security issues, various bugs, and add several enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common...

RHEL 4 : JBoss EAP (RHSA-2010:0376)

Updated JBoss Enterprise Application Platform JBEAP 4.2 packages that fix three security issues and multiple bugs are now available for Red Hat Enterprise Linux 4 as JBEAP 4.2.0.CP09. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability...

RHEL 4 : JBoss EAP (RHSA-2010:0377)

Updated JBoss Enterprise Application Platform JBEAP 4.3 packages that fix three security issues and multiple bugs are now available for Red Hat Enterprise Linux 4 as JBEAP 4.3.0.CP08. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability...

RHEL 4 : JBoss EAP (RHSA-2010:0937)

Updated JBoss Enterprise Application Platform JBEAP 4.3 packages that fix three security issues and multiple bugs are now available for Red Hat Enterprise Linux 4 as JBEAP 4.3.0.CP09. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerabilit...

RHEL 5 : JBoss EAP (RHSA-2011:0948)

Updated JBoss Enterprise Application Platform 5.1.1 packages that fix one security issue and various bugs are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

RHEL 5 : JBoss EAP (RHSA-2009:0349)

Updated JBoss Enterprise Application Platform JBoss EAP 4.3 packages that fix various issues are now available for Red Hat Enterprise Linux 5 as JBEAP 4.3.0.CP04. This update has been rated as having moderate security impact by the Red Hat Security Response Team. JBoss Enterprise Application...

RHEL 6 : JBoss EAP (RHSA-2013:0191)

Updated JBoss Enterprise Application Platform 5.2.0 packages that fix multiple security issues, various bugs, and add several enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. Common...